{ "Event": { "published": true, "date": "2026-08-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-08-10", "timestamp": 1786406581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "fc446c35-d2e7-425a-87bf-02ff1bbaa124", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ffaf67-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371656, "uuid": "6cc2ea88-6c17-4c8e-a72d-e14f7165f524", "comment": "Malware payload (Formbook)", "value": "bfdf44231cf6eb52b68e337bd8ef0834", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371656, "uuid": "a8cc77df-ef69-4bbb-b697-61af46b04ff0", "comment": "Malware payload (Formbook)", "value": "00039bbee16af377452f9ba193a61fbc238ccaf8be4165574192f10bf68344db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371656, "uuid": "961da680-23d9-4c52-95db-13cb1da0445c", "comment": "Malware payload (Formbook)", "value": "366be91cdf3c02cc48a9c301b0ef10f1bf76c3b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371656, "uuid": "19ce869b-7aba-48d8-a9c0-9a5e849672f9", "comment": "Malware payload (Formbook)", "value": "f3071176160853e784d6fa2620f00372c75a11e374ea2cc61771484c3252e54c48a2968e4030873c2aa8b5313c114032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371656, "uuid": "3abb80db-81b2-4fd0-b5cb-943c98dacd8e", "value": "T11B2522152695EA17CD961BB50BB0F3B823785DD9B900E3279FE9ADEFBD36A105D00082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371656, "uuid": "48fae14b-3993-411f-811c-65db697697f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371656, "uuid": "1af8acac-df14-4d82-b660-ff6745647039", "value": "24576:CSO6py5EomdgiNBM/PEmz/jHzV1caVsMwyValkfw:hw5Eomd9mPTLjzzch/yVal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371656, "uuid": "693a8efc-13fe-4390-98ee-b4f5aaf14d9f", "value": 1050112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371656, "uuid": "c067ccc8-8793-429a-bcb9-0a0fba74787c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371656, "uuid": "f3c5d190-5eb5-45cb-8ec7-13e13703faad", "value": "00039bbee16af377452f9ba193a61fbc238ccaf8be4165574192f10bf68344db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca3fc1c-948d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347190, "uuid": "a076eb88-7604-49e8-b5cb-49f82337b4ca", "comment": "Malware payload (Mirai)", "value": "9fdc50e844e1376a149c0ec2ec6ba1d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347190, "uuid": "a13036c9-4ffc-44f4-a8db-80af41c24af0", "comment": "Malware payload (Mirai)", "value": "0017ec0b36f0a10e37951329126e28d8bf03030124de8001061ee3c9193b4481", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347190, "uuid": "f8fb3128-dae7-4cd3-b402-2ce288b9831e", "comment": "Malware payload (Mirai)", "value": "ac5e1786710ca349f5b0fbbe353de44215e40a14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347190, "uuid": "10ce0928-6a25-4b35-b1a0-083b6e3524a2", "comment": "Malware payload (Mirai)", "value": "83bae8e10a8d06f20722599770c8385b388570143f4de69b723ef8e8a0e649e8ead651e225fbf2ebe132014cefc71e15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347190, "uuid": "9bb45604-980b-49ee-aacf-fa411b17c0ac", "value": "T1D4733919B9519F1BC2C21637FF2E8349331723A8E3DB7203DE15AF55339B62A0E2A455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347190, "uuid": "a0621e42-269b-42c9-856e-1be274c7f250", "value": "1536:tg77nl5e+mgYUkOTWN+WfKu8TGp/kYvQnMOZcnESFqE20XgQN:tg77log06WN9fKu8TG9rQMQ0ESFqE2Yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347190, "uuid": "ba4987ff-af1a-41d0-93ef-efcdc54967ca", "value": 75624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347190, "uuid": "11dc4614-34ab-47d9-8ed7-d126146c9e03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347190, "uuid": "df770e8d-b7cc-4327-90c3-e396fa417829", "value": "DjEq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc848519-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339915, "uuid": "1281d476-b262-4a1e-8430-297acf4a5d02", "comment": "Malware payload (Mirai)", "value": "6d9b7701af997b029acf62a4c57e2c63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339915, "uuid": "940c44f2-f6c4-4cd9-89e7-7f6d548a2e93", "comment": "Malware payload (Mirai)", "value": "00a9a0864035e994f255c3bdbcebb5c860844555bf279aa711462f86b0f11e30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339915, "uuid": "deeafbb3-6bbf-4f24-b366-8e2c6defa063", "comment": "Malware payload (Mirai)", "value": "9e8456b975c87c3f5141b7d368d605219e836152", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339915, "uuid": "c2dff772-f21b-4393-8592-9597ef9c5c50", "comment": "Malware payload (Mirai)", "value": "4e2814ea60f8e4345c08bef5ce0a77723da7d8c95609bb12ed09a47367baf2add401228876b36b2670a8117275d0e9f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339915, "uuid": "8915a966-991c-4bd1-b9a5-51b447ef7936", "value": "T19984298882F5FBDEE296FA3983047D0B5C214B367083758561AEF96313B72450AFDDA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339915, "uuid": "b8ddd450-60db-4a9d-b0c4-7f1d012fbc5b", "value": "6144:LQD4/VelUWGaVyFLSRlzr7cC7qe+t0MzWLvCrthIor:gaelUW7yg797qcTCrXIor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339915, "uuid": "d50ee8c8-8165-46a9-8df0-043c81b82b9c", "value": 382396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339915, "uuid": "302fc551-90f7-4d6b-88f5-d2f79f7471cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339915, "uuid": "7d3ac05f-38b0-4d97-9c90-7e91e4f18c71", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60a98c5-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369163, "uuid": "8af49b11-f51d-4095-81df-950243fb2804", "comment": "Malware payload (Vidar)", "value": "94d210eb70c4f5618fc8e2e42dc255fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369163, "uuid": "a9d883ed-dab5-49a4-a68f-126cd4e6f407", "comment": "Malware payload (Vidar)", "value": "00cc775fb18128c434bd5703f4dd29fca48b68791bbc2f9bfa8eb9c3ba7d2a5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369163, "uuid": "9bda444b-591e-4341-99dd-9e41067cf97b", "comment": "Malware payload (Vidar)", "value": "f2cd6a749538c3d57cefa4fb1bd998f6e6a46c2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369163, "uuid": "5e2a3125-1980-4ec3-98dc-fb367568a365", "comment": "Malware payload (Vidar)", "value": "12be8f1f9d427a8c48b8b41ab9a77ff2cc510ca1334da39b684958c021b3f11b83dbe0e84acf8273efb8939e6193ecc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369163, "uuid": "778a024e-726a-4afb-9edf-40b498a35e4a", "value": "T11A826246E25BA1B8C4F7C737939A412656F9BC40223696376FED86711D93330FA182EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369163, "uuid": "c7836c21-052f-4cad-9efb-3c70e5285ab0", "value": "66ebb7345b7f4b21730e0a314cb2039c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369163, "uuid": "9ba3a65d-ae84-4558-a349-8d9366f0f177", "value": "384:OuB3GKyPfMMOIpkVw5T8J81ZTubL9MfDdkx0kUnhwb37+Yd1l:PVi5OfVwhl7d0b3735", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369163, "uuid": "749cbbfc-80be-4003-a12b-fad08498329a", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369163, "uuid": "59b6f915-5521-499b-b02a-aaf6fc108538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369163, "uuid": "5aef5824-61be-429c-bd96-e09a27531f73", "value": "00cc775fb18128c434bd5703f4dd29fca48b68791bbc2f9bfa8eb9c3ba7d2a5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a371b344-94aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786359603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359603, "uuid": "6818206d-7c1d-4e8c-b719-dee7fde7da3a", "comment": "Malware payload (Formbook)", "value": "cdd54ad599d195175f9a2cbb41c2032f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359603, "uuid": "27d079f6-39e3-4e89-9548-483d954af30b", "comment": "Malware payload (Formbook)", "value": "00d9e0c440cc5d6c65a4bd401afb58c2198a281793f4c8aaa1e14ce096d77727", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359603, "uuid": "67b79e68-c968-4b13-86f0-491202c62cbd", "comment": "Malware payload (Formbook)", "value": "ec8bde76752cce88891f6a5319db358e2b23a705", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359603, "uuid": "074dd244-9b79-465a-b3f8-07569ad3aa9d", "comment": "Malware payload (Formbook)", "value": "0c194761af0d6d88bd68ad10877eee320e7a979ccfc0b8dbb373568396638f2d1497799bd0685ffc075ca2a0fac80481", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359603, "uuid": "8e39f9eb-0e2b-48b7-a6d2-39ca26417c63", "value": "T1C553DC549A82758453337B7FB62BA8A0F6760B6B40440917F87CB4909FF1D09EBE1CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359603, "uuid": "fd3e668c-cc01-4126-9cb5-c685cb3cdd08", "value": "768:DcUKceQFwKjoYfpCQRh2LmtQ60H8zTidHBpQZzf8m5dtwEmw6MScQXak/OGnidjO:Dukzf8m5dtw/2AuuQERvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786359603, "uuid": "2baf4736-683d-456c-8c8d-aeefc6b5dcb3", "value": 61459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786359603, "uuid": "d0d9a238-f723-41a0-afe3-fbf7d114b65a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359603, "uuid": "7b685d16-b955-4db7-aff8-1acd83960235", "value": "1-TECHNICAL SPECIFICATIONS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8fdb21-9474-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786336427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336427, "uuid": "760c8da0-0e7a-4ce2-b607-5972b4a8ad24", "comment": "Malware payload", "value": "21f3d7ec5751632c8fe9c03f99c87a0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336427, "uuid": "b9914ad5-e3d0-4d77-8cea-8f8dda6bf288", "comment": "Malware payload", "value": "00f4aa14a269af928879575ce7120518da3d38fe5693921e50c618ee9feb84e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336427, "uuid": "8a2d1bf1-d965-4f94-b33e-72feebd21673", "comment": "Malware payload", "value": "60cd43d460420b7b16083ca6a665968418fb76f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336427, "uuid": "debf5faa-6c59-4d5d-afb3-86ad6eb1c570", "comment": "Malware payload", "value": "6b80a519191f3e34f6ff826e7e3437533fa6bca7ae125e25c993cf33eec340eb238fd5197628801a1bc2eb2dc3764a97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336427, "uuid": "f8636da5-2262-4b65-b008-07c72206890b", "value": "T16523C31BB6A3B47CC24BC0B45A9AD5F1B93178B402213D3FA3C5FA312E35D516A59E32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336427, "uuid": "b5e3f7d3-46d6-4d3b-8de8-1ae9010ab77a", "value": "768:p6axsI+h+ZqquUAi5pY38uCfkeGxgXw3wEalljXTJ:8axsI2IAi368jGxgXw3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786336427, "uuid": "436bf75b-923a-4f79-999d-25208f11bbd3", "value": 46160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786336427, "uuid": "9f94e5f9-8302-46a4-9f0c-0c77f2dee6ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336427, "uuid": "c44626e1-a5d4-4d81-b90b-e096c96254f1", "value": "00f4aa14a269af928879575ce7120518da3d38fe5693921e50c618ee9feb84e4.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6e4a9f-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786372877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372877, "uuid": "79c36b03-64d7-4005-aa20-dce15e0e5e32", "comment": "Malware payload (XWorm)", "value": "d19a0e99402b2aa9062032cfbc58a558", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372877, "uuid": "5da43a8b-e13c-4886-9da2-883c72793a51", "comment": "Malware payload (XWorm)", "value": "0128fb60a5557d520ecd0d61f4b442317ff668deef20f9ee64264c20cf299285", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372877, "uuid": "754f2126-1fb1-4f7f-b534-ddd4bfe9aa5b", "comment": "Malware payload (XWorm)", "value": "0f2565f1e43bfe85ce87c1fdbedfa82a4a1dddca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372877, "uuid": "e0436e10-01d9-4953-a40e-d48398c9c2c3", "comment": "Malware payload (XWorm)", "value": "a7bb517da54e04dcc03595e16a095b81b536c1e82a7be80c66514addd32eb211a77379de8d2f8450a2d7e8fde48721f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372877, "uuid": "3acca9c6-2b55-40b2-84b9-12c07ef7b755", "value": "T1B394BF523D0CA8D7EE3D6372286785862FB4787A4BD215AB7AAFF25648113034E1FD1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372877, "uuid": "f89ba9b0-ad02-44b4-93b7-c20fc9da7a88", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372877, "uuid": "2740c787-6d76-49f6-8b73-7ed08cd243ed", "value": "6144:vwq3Nplp8rtzZ3vxjmMAQFEY86jgGf5LYR1tQ73cnfU71437A28LOB4XoWSpe3IY:vzhufPAgEYFV5Lg4YpA4eM0bCy8wyix7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372877, "uuid": "67cda7b9-c1e1-4727-bdcb-5e396e93a46e", "value": 409384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372877, "uuid": "82fdd66b-6ef8-4c4d-bf31-b61bc7659553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372877, "uuid": "92db20e8-5a49-4558-8b74-188f8a1de68e", "value": "0128fb60a5557d520ecd0d61f4b442317ff668deef20f9ee64264c20cf299285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84ce60f-94f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786389703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389703, "uuid": "53984721-9e5d-4c57-bbd1-ec63e96bd435", "comment": "Malware payload (Mirai)", "value": "6daa27df6d8e3f5895976033dde7f341", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389703, "uuid": "c5bb82db-ae08-4973-9bb1-a84fbfb302bb", "comment": "Malware payload (Mirai)", "value": "014bbcf2d56904052a3f82d384d92d6146e5b903bbc0f09b265aa84571455f2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389703, "uuid": "6014eddb-ffe3-4593-bcd0-da7ccea95465", "comment": "Malware payload (Mirai)", "value": "301cfe01cf8288aae57a37ee6dcca3a996e9533d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389703, "uuid": "fa6592a3-2a3d-4f58-83f8-c5b15e50349c", "comment": "Malware payload (Mirai)", "value": "656d1634ed682e876c4eab235f830faf45b748caf542d8c232736a74b78355d20bca302b3ba67343e5882cb6eea3ed0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389703, "uuid": "309c1af1-aed1-4100-a434-0d8897d2afe3", "value": "T154D30945FD418F16CAC265BBFF4E438C7B2A1769D3EE720399255F20379B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389703, "uuid": "241e4ecb-1feb-41a7-8f7e-737d4e26c0bb", "value": "3072:e29eC2y4vb3OQLuJdH/uwZCcwcAPDSH03lniYj0/HXx:99eC2y47E5GwZCcwFDO01iYj0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786389703, "uuid": "072d643c-d054-404c-8cbf-16c49cc34526", "value": 142776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786389703, "uuid": "b22ff7b3-4918-4cf7-b4ec-0bcf8a159624", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389703, "uuid": "23b02883-10f2-4d26-81f2-9ce0fa6de2fc", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3764f7-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373093, "uuid": "d14e92e3-e0ef-4ca6-b2ce-30efd38b75ef", "comment": "Malware payload (AgentTesla)", "value": "08656ee19ec4be761299611840e593a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373093, "uuid": "63a87fee-bf77-489a-9511-9f8d2d76dbe7", "comment": "Malware payload (AgentTesla)", "value": "018deb8ea5ecec507e0261f58ec3dde7843f85c316fecbd26b9eac8e336ac727", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373093, "uuid": "af6d0dde-3ffc-4ddf-8ed2-3c783fbdbaf6", "comment": "Malware payload (AgentTesla)", "value": "f3533dc17374a810c4fc1fc85b54f0555f5adf54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373093, "uuid": "6ac6901d-1c9e-4e86-a1d9-1fd77613ca8c", "comment": "Malware payload (AgentTesla)", "value": "02f1c3ec7c8a51b613f562d1010e939ef0427bcbf5f8982340c19e35ee546ba697052c0bc5e7ed65cbc0ce425ae9af64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373093, "uuid": "08a95950-b682-40f7-a3a7-fa99ea8db3c7", "value": "T129250151232A9A52E0D6CBF6BD20D37033A50ECF38D2C3925FE66FF774297851A44692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373093, "uuid": "e6daac9a-fa26-4a78-b733-6d5f43e175c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373093, "uuid": "dc449e77-49dc-48fe-bf16-20cef8d82e6a", "value": "24576:OTFYx7OIdexshWrgdvEAd44gNQRNcbCbMhqfQQhbp50:xdeuhs4BNcyMIYQdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373093, "uuid": "164429d4-6df6-4d7b-b383-ad6bd81793ed", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373093, "uuid": "c27e6aad-941d-4809-95cf-97eed81cb313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373093, "uuid": "2a4aa806-c31a-410b-b8c9-2c125861531c", "value": "018deb8ea5ecec507e0261f58ec3dde7843f85c316fecbd26b9eac8e336ac727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25cef94-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373855, "uuid": "9c8193c4-6c60-48c9-a2cb-4e6b9102b62f", "comment": "Malware payload", "value": "6e3febcd3330001b6608d8de7f35e7b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373855, "uuid": "7d077577-8d07-49c1-bcdf-90e21a307bc2", "comment": "Malware payload", "value": "01978a95769418d0c985edc3b54e45e550ed9832f5b4ca710a6cedff7a42348d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373855, "uuid": "5a71961a-de0e-49db-ac3f-23fd97023710", "comment": "Malware payload", "value": "ddd8947b2dc8783808492d52cd37ee7264f3bc4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373855, "uuid": "6a0fceda-7677-4f78-85fe-c5adba202a20", "comment": "Malware payload", "value": "637aafabd3bf0a8b00ea5a6b780e5ff6823394d1ce6167a29cf04a467bb9e03f627c9c7abb2417a540aebfdfbc685ef1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373855, "uuid": "2d35e57a-ccb6-480b-9610-4e25deaeadba", "value": "T1F665DF45D9C405A0ECA9AB31A675CC7446B27DAE6830E61D24CD3EFB7FB73836012663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373855, "uuid": "106e732c-aa21-4149-b16c-e429fff32d62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373855, "uuid": "972fde98-86e3-4065-9f29-1aa1ba8c62dd", "value": "24576:iYJE26xuUum89aFt5sO4qFfrYEzRDtMfLhZTEi81q:Rp9s89aL4yf0+RxuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373855, "uuid": "3ebefb8e-b916-408f-b86e-54eeac1bfcf7", "value": 1523712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373855, "uuid": "9406e9d9-c45e-4f3f-8926-636ca60d8fb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373855, "uuid": "5ed29e71-ecee-4a52-a358-cf9b8cd517de", "value": "01978a95769418d0c985edc3b54e45e550ed9832f5b4ca710a6cedff7a42348d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6361328e-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786372810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372810, "uuid": "afdd6c5a-b0cb-47db-8301-00c774f34efb", "comment": "Malware payload (MassLogger)", "value": "c023f0fd63a3ed5d50299d7aa4af1e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372810, "uuid": "0e29ddba-fbd4-4fe0-ba89-dd9ed984ce93", "comment": "Malware payload (MassLogger)", "value": "01ad626abefeb19a1fd65ec27599b6cdc0d025dc42261317e77480860ffa7a09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372810, "uuid": "f409d50f-065a-4048-9ffc-24c36ee7f867", "comment": "Malware payload (MassLogger)", "value": "be70dbedfd79d3d7e3146e08cdbec5701329c39b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372810, "uuid": "7456d683-fc7e-414d-990e-f3cd2825d963", "comment": "Malware payload (MassLogger)", "value": "7ec543ba3949522f12b56cf44d4da7dcc9ac72718ead11b011a6c85d9202d514501dfa64faecaed71e1b77c3a6ce2bd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372810, "uuid": "196e263f-c1f8-45c1-a31d-6b72a8c31994", "value": "T12D05F1151316DA41E0E68BFAB8A0D37533790DCF7AE2C3969FE96FFB38153805558282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372810, "uuid": "97858985-0d4e-4b81-82da-dbaeb83bba7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372810, "uuid": "0fc38ab8-47f5-470c-8a92-a9d54bd5137a", "value": "12288:vxxltnn0gGfnQkfXfFRp1z2VXXFNOX8vlZk4ZfMce8+6m51IPB0/Dsn:vp50bQkfXdRpleX1JOM0ceMmk0/Yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372810, "uuid": "f0381349-d5d0-4e98-947f-b028dd684d35", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372810, "uuid": "2b1a3cc7-1eeb-4195-b1ec-0029f3385a14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372810, "uuid": "424e1aa5-d845-41d7-a4f3-f8910721ed8e", "value": "01ad626abefeb19a1fd65ec27599b6cdc0d025dc42261317e77480860ffa7a09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe18c64-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369583, "uuid": "6767f814-b3fb-4c6e-b4ca-db3790fdd201", "comment": "Malware payload (Vidar)", "value": "89a36b401a7b2c1c6264527cc18da6a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369583, "uuid": "1ed55052-d2c1-49c9-b7bf-a8396a44544c", "comment": "Malware payload (Vidar)", "value": "023158a37cbae730c63eee626a396dc22f305ace61471498e13b4b1f36356502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369583, "uuid": "f2f2e917-3107-492e-8d7f-9dce898e8a92", "comment": "Malware payload (Vidar)", "value": "f9f0d2cb4df5e79dac85a1bf1d116589364056f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369583, "uuid": "4e040d38-1357-40d5-8050-b5f5b67a7db5", "comment": "Malware payload (Vidar)", "value": "19a4f783401dbcc1dfae6ca5d42befbc0325eede0dc209d1a078a804d2e810b47779c36945b0263414dd38889e29f50d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369583, "uuid": "20085a8d-1038-4f37-aa30-9f5ac2307eab", "value": "T193824044E11BA2B4C4EBC337936A522356F8BC052631963A6FEC5A325D52730F6186FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369583, "uuid": "75ea771a-ced8-42aa-b590-f1ea93b0203e", "value": "351526ecdd2e2b685a290935bb32a240", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369583, "uuid": "93fc0d99-6bd5-4527-9550-de98e9602471", "value": "384:O23lKoXX1dLwdvNgmuVgXHM5Py1fs7dKcchKtBbVqojy6Vl:hlKE1Kgm6y1rhwkSys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369583, "uuid": "4e00ed3d-a1ea-4e78-bcd2-08fe9990b86f", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369583, "uuid": "200240b9-9069-4bd4-8c5d-6a9d27ea41b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369583, "uuid": "2e89ef42-fb75-43af-a814-073c345de897", "value": "023158a37cbae730c63eee626a396dc22f305ace61471498e13b4b1f36356502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4dbe18f-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786373403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373403, "uuid": "8924259f-0ef8-492e-9e02-6a12c5d7df9a", "comment": "Malware payload (AsyncRAT)", "value": "a18c0d2d31da3b0d474fbde83cab5bb4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373403, "uuid": "6c64351d-52d7-44b4-b72f-47b3ba5ecc56", "comment": "Malware payload (AsyncRAT)", "value": "02a8f08e3340b89c987dfbf1a961487cdac104d988b8f98c036eeb226c25c9e4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373403, "uuid": "f46e3114-857a-4a2b-9d50-ffbb58183daf", "comment": "Malware payload (AsyncRAT)", "value": "6c854521579190958e7c90c3e72526268cd359f8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373403, "uuid": "ed96aa45-f4f0-4485-8fc9-c5ed1d3c51dd", "comment": "Malware payload (AsyncRAT)", "value": "a04309570516d6b53cbb91df62d4a579033aa6a7a4eaa042127c430b81d41f91d41bf51ccea9a68da5dd3fd138c5ef1a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373403, "uuid": "0f8f4a36-33b4-4410-84a5-caeb762d0163", "value": "T18CA5BD15E3D821A8D427DA38CB54A333D2B1B9224B75E48F0A99C3061F77A919FBF711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373403, "uuid": "5787158d-6d84-4fa5-8f86-533fb2bc0f76", "value": "65e41035c05e4ebec29685fad2d2799b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373403, "uuid": "2ad3015a-f328-42ad-9666-ef52e29639a7", "value": "49152:VAIkXxxl0mFiaPgq0P1QBhQKLwyFrkuaUEXeo5I4Nbekxo41C2LJr/:iPATqPUuaUEXeo5I4Nbekxo41C2LJr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373403, "uuid": "e3223d18-12f4-4712-b40c-223ca82b5bb2", "value": 2096128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373403, "uuid": "355df08c-3559-4590-9ea4-10ddfc7c71ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373403, "uuid": "4873e23f-2313-4383-a3f0-72d405ec1c1a", "value": "02a8f08e3340b89c987dfbf1a961487cdac104d988b8f98c036eeb226c25c9e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d496a5-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340058, "uuid": "c2bc6e5f-f0a3-47ad-a169-5a97d2ff2887", "comment": "Malware payload (Mirai)", "value": "d39f8197f546e735509a01c07af97992", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340058, "uuid": "5bf13ed4-0683-41e2-8463-27f7e01a5547", "comment": "Malware payload (Mirai)", "value": "031a9905b0f81f307d5e6682d7cc35069653dd42a9caae81bcc3ee4cfb74c2ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340058, "uuid": "cc62ea62-8615-46b4-99ac-641d8534809f", "comment": "Malware payload (Mirai)", "value": "a21a0c19a233979058160aaa702e24e0c407b9da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340058, "uuid": "fe9f683c-f085-46f7-aeb0-b7b586f97220", "comment": "Malware payload (Mirai)", "value": "4a39594d5ad7cd087b62c1ab768f4d7b8d5f48c5f0aad50e14da6c82ad53d33649e966de319f6dd1fe5e3e29212d3ca6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340058, "uuid": "cb855bfb-1d75-4be4-a28c-74a2a8eca1d9", "value": "T124A40B49D2F1E7DFC018E5301632BE154AF3093638D3269A325DE77E26721994AAF9F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340058, "uuid": "8b1272c3-6a91-40fb-8661-8fbe1d76f8af", "value": "6144:ugPCi/WkTnVxG/wEkrkHdo7DUHiZqtv26feFuTXL9cDSO+d0hZZ:ugPCi3x6fiXce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340058, "uuid": "bf186199-eef4-4f85-9143-dba7b1c55eb0", "value": 458928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340058, "uuid": "875e3c7e-5533-46a5-be8e-c8e410d6aae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340058, "uuid": "e7bbdce2-91ad-4584-84af-e9bd74df6ffc", "value": "pid.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec6232c2-94e6-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786385495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385495, "uuid": "12061e6a-0a91-4828-875c-8cdfbb03acf8", "comment": "Malware payload (ConnectWise)", "value": "f90b80b035acae48cad08d8d2bb3ff0b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385495, "uuid": "175fc3a2-0480-48f7-84c7-45e9c4e8a4d3", "comment": "Malware payload (ConnectWise)", "value": "031dcce29761f42a1b40767b358b18d70e8745b233dd21f6f673b7b45b5a60b4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385495, "uuid": "fcfe4b1b-bcab-409e-a9b5-8924a65bf155", "comment": "Malware payload (ConnectWise)", "value": "621a3c86c25d1895fd83ce2c0688c2a8070d6d7c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385495, "uuid": "28b8589b-d69f-4f10-9a64-5d56f01b0493", "comment": "Malware payload (ConnectWise)", "value": "796c25bf6c718ced0de2434d1c367a7d435ca9ea640992ae67651d968f7a39ccec85947bb18aebdd0436ea64fb7d8d85", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385495, "uuid": "6c4394ae-fa94-47f5-89e4-479dddba424f", "value": "T17A46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385495, "uuid": "c6e241d8-c2b1-4ade-bc2b-a7b88ec230ec", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385495, "uuid": "6e7cfa03-387d-4646-9f19-9d40f7eac9ae", "value": "98304:YzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:YhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786385495, "uuid": "ec2c2918-2092-4597-bd6d-aecbcbbb011b", "value": 5643248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786385495, "uuid": "6d7147d7-2dc7-47a9-8544-42a6ea576088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385495, "uuid": "e19896a6-da74-47f3-9bb4-5df605d274ea", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059b4abf-9501-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786396704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396704, "uuid": "64737b99-d58c-4030-9215-e148d00a2acc", "comment": "Malware payload", "value": "c3d2a04288cf52ebf44e0943a82b1ea3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396704, "uuid": "1b4d4f57-39cc-4cf8-9f3b-2ec9a0ac7c85", "comment": "Malware payload", "value": "035e39dddadeeacb1915619a98b30872087f505c9d3cf68a40d738ddcddfde57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396704, "uuid": "656aa192-dbd7-4eb7-8f25-d71985cc872b", "comment": "Malware payload", "value": "cdfc412824976e66ce3af4cdee1529ece1217472", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396704, "uuid": "7511efcf-0492-40dd-8d6a-f00ef5b1f581", "comment": "Malware payload", "value": "5e689beb675341ec8713e1cdd796f6373dec82337231f19d0867913d4096fcca4a4bcf5a732f1b4654180195ff98cc37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396704, "uuid": "4ade7bd2-e6ec-4260-bb51-c055edb9354b", "value": "T170562BC2E961C25EC6393931DFE5F7D8A3392E3495C0AA8EC9C8F33D08F3155856A961", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396704, "uuid": "97ce0745-2ecb-4132-b387-5875adf6dc07", "value": "49152:9GXK1+2HWOVvWJCSPg+2igMCLzwYGQFl9A/igoggggDigoggggoKgMggggsKgMgQ:oa1+22OWCH6zIUnHjEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786396704, "uuid": "76e3647f-70b0-4aef-9d7b-a5c4f809ebdb", "value": 6095010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786396704, "uuid": "14a0cb17-59c6-4824-8dc1-b11236b23b69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396704, "uuid": "cca88734-e767-4fa5-b7e4-42dabcbb8b27", "value": "bot.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e01cd8-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371202, "uuid": "a93f1248-171b-4d5a-9349-3866d17653a9", "comment": "Malware payload (Vidar)", "value": "7f35f37546899c2bcc2f0e97248c925f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371202, "uuid": "eb95c9e7-a9ad-4107-bf07-9bc26b709cd1", "comment": "Malware payload (Vidar)", "value": "04171247bc9c2c317951debf194b3b80ce37d015131e8c569aaf9d39b810b9f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371202, "uuid": "62e70a77-1aba-40cd-81c0-641f884765f2", "comment": "Malware payload (Vidar)", "value": "eaa7a74528981bdb4e51b5fada4679a5275b35e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371202, "uuid": "9ac311b0-637f-4517-9b92-dde26d8fd26c", "comment": "Malware payload (Vidar)", "value": "8e0eb28959934383afb5ecef0239d4eab0c5a740a35ebe06a12e868d7d6c9ea598ad0f912b57b1ca64fad5c4d6c37679", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371202, "uuid": "4a4fe5da-9fe2-4714-a86c-080aba99efa0", "value": "T14942F9D37187E0B8C369C238D7AF56B68267304806266FFF49ECC9543A43212A579278", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371202, "uuid": "8eec1db4-3edb-4c5e-acdf-13ad2d85062b", "value": "351526ecdd2e2b685a290935bb32a240", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371202, "uuid": "21ac17b2-eccd-4ec2-85ec-035a2315ff5e", "value": "192:OSiJGsCoGIYbISWWFshLwRDiIO484Z5M4M8Z9ViGhhSKQ3VG2s:Ol/GIuILWSLwRnOAC38Z98GDSKQlGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371202, "uuid": "81f16547-3421-4003-8485-a3b15145e871", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371202, "uuid": "c21f472e-e26e-4310-93e9-221b675988ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371202, "uuid": "924adbf1-19ff-493c-ab74-04b28d849f51", "value": "04171247bc9c2c317951debf194b3b80ce37d015131e8c569aaf9d39b810b9f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce795970-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373848, "uuid": "3a73c48e-bda7-436b-94bb-4ab2a0e0a88f", "comment": "Malware payload", "value": "7d806e52e4569cef491e6e4a43f9bac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373848, "uuid": "193df4eb-f2df-4d38-a1d6-a66096a4570a", "comment": "Malware payload", "value": "04173419b3048b03ebd52cd8ac36aad39451de40a728139823d4a97fe85efeb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373848, "uuid": "55ed3cd3-8d60-4ef3-9094-84ca5bb554fb", "comment": "Malware payload", "value": "d1b2582afc68f4526b4c63ec0b5d8aed01fcbd78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373848, "uuid": "15a43f80-87e6-474c-ace5-18599d97674b", "comment": "Malware payload", "value": "88f5726fcfaa9bd9ee8ad360d5b26cc08657b6c595e0d7adea891f65395f0f32cd62c80b843f0d65393902936a64fc59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373848, "uuid": "90409fcf-da9d-40eb-a417-ab50638c993f", "value": "T1ED769B07BCE588F5C09A923189B756A27B75BC090B3127EB2E6067783F327C09D36795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373848, "uuid": "ba247ec6-b8d7-45a1-89d5-abf7a9711276", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373848, "uuid": "4a824b0d-7dc7-4b48-8a17-5cea9f209fc1", "value": "49152:a/+Y/ld6OZlYB377Txc80NoReobHkJM8P7b4fPwvaxNzYIl4:al/u9X1E688okNzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373848, "uuid": "b8281126-8817-43be-ae54-f8c97a4d37f1", "value": 7127040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373848, "uuid": "ef10121f-6cd3-4566-a3fb-7da18d580676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373848, "uuid": "4a91a8d2-39d2-415f-be63-7b1e65c99408", "value": "04173419b3048b03ebd52cd8ac36aad39451de40a728139823d4a97fe85efeb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5779c7d-9462-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786328682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328682, "uuid": "d5aeab39-3cfb-4d64-b2aa-e5f3d60a4e84", "comment": "Malware payload (Mirai)", "value": "ead39e75bf397aed5a6dc076662d2014", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328682, "uuid": "7b533250-5858-4f69-95f0-e394b0565800", "comment": "Malware payload (Mirai)", "value": "04cb291caba794af54a271778636d58817a9056e6cfa6e28ae7389e3cefcfcb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328682, "uuid": "d97fd3cd-7369-42a6-b288-93f1c0cedeeb", "comment": "Malware payload (Mirai)", "value": "faf3b4e4bdea36c6c7d04a74dbfab3492158df8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328682, "uuid": "351ee62e-e4ad-4a55-ac24-e083d40bb24d", "comment": "Malware payload (Mirai)", "value": "39de9ba5d54e01bbc1736374af2fba808b1524543ce780bb9ec8f25ebda190a6930f28c7bc31ebb6a480e8234d1f1836", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328682, "uuid": "2996cf75-19e3-4e2d-a37b-e31adc1adf98", "value": "T1AD532A55FC819712C6D122BBFB6E428D372A5368D2EF32079E256F1037C796B0E6B601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328682, "uuid": "63a95df4-c5bd-45e6-948a-565910e0b0bf", "value": "1536:ltc29GVTKL+IdnbqsUY9uufcQiHWBCt3LEe43uE:ltcxG11utUuufLAtYruE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328682, "uuid": "e8200aa1-4ee8-4a22-9ee1-e122f59997e1", "value": 63600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328682, "uuid": "5e035d95-7b66-44d5-8007-3e7144dd6b0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328682, "uuid": "78d70004-41d4-4691-a0c6-b49d6d1a08dd", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d99c74-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372760, "uuid": "555fb3bc-3796-49e8-8106-a02c82c82f6f", "comment": "Malware payload (AgentTesla)", "value": "a8f7de686ac1cbcebe22bf17ef2e85a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372760, "uuid": "b7c0af6e-62d3-4397-8223-6e8a0e65146c", "comment": "Malware payload (AgentTesla)", "value": "052e4076783100b7f0ade5caa592a2d94f23097d3bf959bd353d83a8da327536", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372760, "uuid": "a8c116a2-3b47-43d7-b8e2-517d592211d3", "comment": "Malware payload (AgentTesla)", "value": "b6f1d854a1346fd8b2870a4e64bf865fa55212e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372760, "uuid": "a3491532-f82f-4abb-b4db-1aff9e48e7e2", "comment": "Malware payload (AgentTesla)", "value": "e1fc2e47e2c46396ad59bb6ccc21dfcd33c485a1d0b3bed4fe62f158c4d37503f3adca8b12f46dd73f13c24031a7c83c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372760, "uuid": "383a1b58-8b3b-4610-a4f0-7471c93b2900", "value": "T14425F104235A9A42E0E6CBF2BDB0E37033641DDF78E2C29A5FE95FE778293815454792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372760, "uuid": "935e27ee-6f05-4d98-8c4a-c453849e262e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372760, "uuid": "103a2ac8-ab01-4f1e-a1cd-a3ea63567c98", "value": "24576:ecCp50zkogy/qk9fq9AZf8caPbwvcZRF0y7C4W8CGzPK2lII8:ecCp5kykeAZf6DMcZIy3CGzPKYII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372760, "uuid": "e2bbb4eb-1460-41e4-8e0e-cba938f4fe82", "value": 1036288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372760, "uuid": "bb466ad9-6754-4a9e-a62b-c12b7fdfd791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372760, "uuid": "7ab09724-bf69-40aa-8b5f-feb46ab7702f", "value": "052e4076783100b7f0ade5caa592a2d94f23097d3bf959bd353d83a8da327536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b3976a-9501-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786396845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396845, "uuid": "2beffe34-1797-4239-9780-b4e693e76ee1", "comment": "Malware payload (Mirai)", "value": "f8bc08ee97ebf8ce6ee5c58c7af370a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396845, "uuid": "e9dd42c8-017d-4306-af3d-fcd8cdedb087", "comment": "Malware payload (Mirai)", "value": "05466e31a37e9df944f617737551e98f5577c88b650625794fc51e41a9bbdff1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396845, "uuid": "d5f418b9-7e53-4c54-acfe-8075a105f63c", "comment": "Malware payload (Mirai)", "value": "7c59584374f300834ba508a88ad5c0d858b37ba5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396845, "uuid": "b517383b-7b6b-4dcf-ba2c-e345d093df06", "comment": "Malware payload (Mirai)", "value": "cccbffe9bc23885d6467cc483d8a9501d5506523679ecc016dbca642942b5d58b688e49d4704008844ca4b84271f8c81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396845, "uuid": "61849e70-5197-4e18-9bd1-d0a1df044379", "value": "T1BC14D81A9F620FFBDCAFDE3702E90A4635CCA50722A53B353674D524F50A94B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396845, "uuid": "e8cd6676-f78f-41db-ac6c-cb12a1209a20", "value": "3072:CeNEKj8iCoQ1W/xGgSnLq2wRIup3uo1+HmCK:3p8h1DgSnpwqY371rC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786396845, "uuid": "43543326-7023-4f91-98d5-3c69cdbbe5cf", "value": 199620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786396845, "uuid": "4a3ee439-3320-40ca-9105-7d10f1866599", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396845, "uuid": "43627874-728e-4377-abee-f528d8d316c2", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0bb4ae-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1786372266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372266, "uuid": "b507d834-475b-42a0-bd2b-576833131c1b", "comment": "Malware payload (LummaStealer)", "value": "17a98c2cd387216bdd96ef9574b45658", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372266, "uuid": "a13a5f1a-59d4-4e28-a113-4654505aac4d", "comment": "Malware payload (LummaStealer)", "value": "058721f3334dcc2ea2263ca4fa6bf9ba683e8aca0bbec979c2f206c49c496065", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372266, "uuid": "a69d3073-8035-41fd-ad19-296ca9d138ff", "comment": "Malware payload (LummaStealer)", "value": "1c4730b7346dced03c2db223fc9239eaeb9715f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372266, "uuid": "bd5d9021-ca6e-4cb0-91cf-fa57e13128ca", "comment": "Malware payload (LummaStealer)", "value": "b127443d7e59f3d7dfa681ce64c888c920f84003a976120c1126b0a11463b2802f9f3095843827f017def7a842f6842b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372266, "uuid": "8bcffe17-7ed7-4e12-958b-23ae110b3d8e", "value": "T1B2D55B10FEC749F6E903163244AB62AF27386D054B369B97EE447A7DF9772D1183230A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372266, "uuid": "de2a5064-53c7-46d2-b3cd-ec5cabb9107e", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372266, "uuid": "145bb32c-8510-4844-b892-432f5fe5a91f", "value": "24576:pCjgh0J3/gg/Lcd6F+NhBeOPAP5vIlTqHbG/CwBZiTO6XOFXnAU0X8s208Byn7fV:pIgYUNhsZQ0d8kfKYDHB2TdbQJiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372266, "uuid": "61bf14bf-8d93-4ba3-82ae-72d9e64915c0", "value": 2977792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372266, "uuid": "f14187b2-0c6e-489c-be85-ac56dc18a3bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372266, "uuid": "c854758f-16f2-4ace-9f8c-f42d3a52b080", "value": "058721f3334dcc2ea2263ca4fa6bf9ba683e8aca0bbec979c2f206c49c496065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d6dee8-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786367925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367925, "uuid": "17bcf757-6f08-42ad-abe7-d25929cfa900", "comment": "Malware payload", "value": "3de7ef3fd295442cf5a24e64d86aade2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367925, "uuid": "dcf62b12-78e6-4bf0-9696-2f0c149d0fcd", "comment": "Malware payload", "value": "05e54a22ea7fb9164767d74f846d225f5dddd2a1c1d21b23bff9b6f359ffd539", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367925, "uuid": "a9b7b57b-2939-40de-92f8-c595269cccdd", "comment": "Malware payload", "value": "43a4a8a12885c381eeab39c8809965cd34e43ffb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367925, "uuid": "b3da70f8-7f1b-4269-8495-0a6ab4a0e452", "comment": "Malware payload", "value": "95418642574cac2b62fb8d5c677aef84e6f365474a3e50520318214c20478746e4217b4ae2a721923bb3f87674b76957", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367925, "uuid": "abef1ec6-7733-4b41-99a1-0ce9cb405d5e", "value": "T1E8236C651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367925, "uuid": "21157c40-cb4e-4f3a-bc0c-3619121e9242", "value": "768:AXRWNGxVJ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Ulx0cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786367925, "uuid": "c0b8b394-da6c-45bd-888d-b9403798f929", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786367925, "uuid": "cb5e44fc-0148-4ef6-bde4-f2efcac933f9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367925, "uuid": "e00a0959-4d7a-4917-80cb-f9f66b76ba3a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b74ac8-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371760, "uuid": "02b65862-329e-485c-9ead-54e10b1c30f9", "comment": "Malware payload (Vidar)", "value": "16e209cc54bad3ec1096bff195c75991", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371760, "uuid": "93e1b7bb-45f9-46e6-a3fe-6bf2413a9526", "comment": "Malware payload (Vidar)", "value": "06516429ea8e31760bf22e48b5b116fd5e89a062d23daf4e880372984805ec9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371760, "uuid": "0438f8d7-2059-4f6d-8c7e-f26123b85d50", "comment": "Malware payload (Vidar)", "value": "1271d2de7ec1d4034d9f3a150fc731a93320e3d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371760, "uuid": "97562946-ed3b-4c1b-bfb8-a31faa074d4d", "comment": "Malware payload (Vidar)", "value": "569e0f334bb58a8406317388a343bc9cecedbbfff3af7a2537d219f6c80b979df9dfa170b50d829ea40f95a714a12eb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371760, "uuid": "01fbce69-9729-4960-86be-ce46323aaba0", "value": "T1D782A541E15BAAE4C4F6D3326716166725F87C203231A77B6BDCA73A0E82770E7502ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371760, "uuid": "62ec28d7-e13d-40f1-b085-da6712647c55", "value": "bb652ddbfc6d78f25974f95364fa638c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371760, "uuid": "618249f2-6baa-4842-99ff-76b7ca26a716", "value": "384:I4cZKPTs8v//HGDPsBeMx3+X+cz5Nkm8BxlckVCwlcqMy:EZiP7BepUm8BbckVCwlcqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371760, "uuid": "bf698795-3191-409e-bbdc-202d0f387c9e", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371760, "uuid": "e36e1067-ce43-4981-a0ce-993e285d1db3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371760, "uuid": "add001e1-14c5-4e94-ad25-f6718d659141", "value": "06516429ea8e31760bf22e48b5b116fd5e89a062d23daf4e880372984805ec9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d620b1-94f5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786391791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391791, "uuid": "99c1bbb5-fd31-44c1-82f0-822eb8f20859", "comment": "Malware payload (Mirai)", "value": "ce4679f696cc9425d1910c2c01b147bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391791, "uuid": "951cf940-8349-497f-843b-3950e60d952a", "comment": "Malware payload (Mirai)", "value": "0686b544552fe48cee8b3dca8cd397fd43f066b548c6fb5fb7942a8f3ae487ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391791, "uuid": "f85e96cf-ae90-4b00-b64c-887de9dd8bc0", "comment": "Malware payload (Mirai)", "value": "bb43f0f9c5c23982bd954399cb4c7479bcc0547a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391791, "uuid": "11e607bb-afcb-4692-b411-128d3fc17949", "comment": "Malware payload (Mirai)", "value": "fa5a8c8c2e0eba146afda0ed0c90e26979841010c45212e67f13188e1a47cd73c5d8b1eefc06b9fe272a86792743c317", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391791, "uuid": "177e530b-15aa-496f-bdd6-e98fcae38df7", "value": "T19E14961A6E228F7EF278C73447B74A34975D23D627E1D684D2ACC1141F6029E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391791, "uuid": "c8366979-647d-43c2-9db6-2aec7baa5fb7", "value": "3072:EsynaW6hmKOBhgB6WfQxsKjFZQkdv/QM/mskXwmw2oIPYn3wHjM2:Es6aW6hmKEC6+QfFGU3sXnfzPY3c1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786391791, "uuid": "7996d9fb-9bd4-4e56-83cb-0ada22f75daf", "value": 197348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786391791, "uuid": "8b1a8e8b-6255-4c5e-9b84-9dc74b6c43b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391791, "uuid": "3c124809-c183-4a67-b621-d921c81646a2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348ccfe5-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356840, "uuid": "1a6f9d50-a580-427d-84c0-a118bfde5f69", "comment": "Malware payload (Mirai)", "value": "23e8b14fdef46e1ee6ec464b8e696dfe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356840, "uuid": "b363a3d9-cd83-4c43-ad80-1061817f86a7", "comment": "Malware payload (Mirai)", "value": "06c18b2b230de80ae2f1cc137b228f91ec1973f2096a952cbcec8242ef5cdce8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356840, "uuid": "4cb79517-9f1c-4d5a-bb36-999c210f6fd1", "comment": "Malware payload (Mirai)", "value": "d12d091f9536bbbe3b06b8c97228293333f8c43a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356840, "uuid": "452e6514-e0c8-4d67-9dbc-e8a75d2b9aa9", "comment": "Malware payload (Mirai)", "value": "41bd81a241559752a16712744772787eda109970774e903510df6caa3628e7fdf7e6f1d4a23df61db2e647d4c19d6d72", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356840, "uuid": "50383a97-c9db-48ec-9992-67a0625fb3f9", "value": "T1E744E80AAF610EFBE8ABDD3712E90B0125CCA54B22A47B357574D914F14E64F1AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356840, "uuid": "9a0ed368-a4c4-408c-89ba-4d2e48a97f37", "value": "6144:cHA+6e+eVEavlfEQ3XI+SrZ4liC9eJblqpKXfpyh3zAOs:SAbHcEavlfDHI+SrZ2iC9C5UKX9Os", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356840, "uuid": "cbbc34bb-455c-4380-b4f4-1474cfdcd9cf", "value": 262484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356840, "uuid": "4bb37193-d8e0-454d-8bd2-a02bc46b7b33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356840, "uuid": "b51e9433-6c72-4a79-82b6-bfdc24c9b699", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f61b58f-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368589, "uuid": "9c3b01b5-7865-4873-a424-5c9e048becbb", "comment": "Malware payload (Formbook)", "value": "92b960e3f922ccf73c1e8358bb20208a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368589, "uuid": "6d5bb316-d496-4084-8ab7-dbbe138e8c61", "comment": "Malware payload (Formbook)", "value": "06c9642c64e601c7e4d3ffc38bff632bcb163e5fed8dccfe6a85566289058981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368589, "uuid": "1e6132bd-4a4a-4615-9db5-b802c990fc98", "comment": "Malware payload (Formbook)", "value": "5775ea7aa9633d31a18202c57f8a13b94eabe9a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368589, "uuid": "da7df2da-1d6a-4f58-b787-b24717457a0d", "comment": "Malware payload (Formbook)", "value": "f38a146f4243afe2e4781a9d2b17bf9e58349d8c601512958a3255d75fc5427f8bd271ee385564fa8c556c03e4f2bab6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368589, "uuid": "02041124-7968-4b2a-a607-1a68b30e613c", "value": "T1DB3501C0372AA715DE686A708535ED7853A83E257410F9E26EDD3BC7B9AD3018D1CF82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368589, "uuid": "2d8efb9a-6f8d-43d2-87c6-26ac6c54afc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368589, "uuid": "28278a3c-fbfe-4793-8b99-f24126b67007", "value": "24576:XqGkEOy4GzBH3wZXZFd9bePDA6qMEBUJppQEOqcXTG0sL:XhUyBH2VSA5ZUJptcXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368589, "uuid": "63893aa1-c652-4941-a1bc-a54e53f35d83", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368589, "uuid": "cfe61d52-97f1-403b-9243-b470bfb45a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368589, "uuid": "0eaf8526-82e7-4feb-9853-a1d056d6957c", "value": "06c9642c64e601c7e4d3ffc38bff632bcb163e5fed8dccfe6a85566289058981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da216a9-94ba-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786366358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366358, "uuid": "80786a0a-eb37-4253-a885-29bd90a15b74", "comment": "Malware payload (Efimer)", "value": "fcb42598e3f3421216a3ca3351fade08", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366358, "uuid": "356f77c0-472b-4671-b619-11aa37f6df00", "comment": "Malware payload (Efimer)", "value": "06e92e3dfd2818d563c474f074a168bd1a47b1e6c24cef73b088821bc81145c6", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366358, "uuid": "fd822dce-9d44-4175-9171-3b5490296e2c", "comment": "Malware payload (Efimer)", "value": "e989a71404e2865fe6c2e38980811bf149983b73", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366358, "uuid": "93961595-f2c1-4f95-9073-d0cc6a1eef5c", "comment": "Malware payload (Efimer)", "value": "93a4ba09369ae03189fa56b2261287045dba3f7ca1f944b72b64aad237df81f15ae7b418ea2b304cc20273a91659ed54", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366358, "uuid": "27a069ab-8d39-40e0-988a-607b6a41a391", "value": "T150E633086EE0218AFDB3917CDDE15450E1FDF8AB1B31C58B872487765D271E09E3AA27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366358, "uuid": "4b66d2c0-af07-497c-8f26-5605971cfb85", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366358, "uuid": "b2366d10-6c83-4264-80c9-cd041cc6f067", "value": "393216:AMwTUpHmdaHQX80DXMCHWUjRcuI3/PGTAI:AdUpmfX5XMb8GH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786366358, "uuid": "c370e00a-e65b-4b2f-8cd8-72653733380d", "value": 14010141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786366358, "uuid": "000cd51c-3419-443c-b07c-5cfc9a01bc9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366358, "uuid": "e40dc838-ff83-449c-856a-b581c5a5ec68", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f148ae0-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371943, "uuid": "49d57f77-aa0d-48d3-85c1-dab3290d930d", "comment": "Malware payload (AgentTesla)", "value": "0f40cc16ea9517a309a2fb636eb2ccf4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371943, "uuid": "9cb60ece-7b6e-4eee-8a13-de739e1a0de5", "comment": "Malware payload (AgentTesla)", "value": "070964628f8a82b5e4f80476803a8f2838a7b5e8f51942679b88cc6c0378efcd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371943, "uuid": "5cab25e4-f4ee-4805-ba9d-78adcc0fcff2", "comment": "Malware payload (AgentTesla)", "value": "77c73238c36ab251227adecd2471f7417c95f7cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371943, "uuid": "be378c5b-a106-4d2b-9f5a-5768d95e19d1", "comment": "Malware payload (AgentTesla)", "value": "ebb0cbdce9fa19e4f21a52c0d964be07e58c7b4a005230164abb0ab7de399a411d7ad70c8355bb2adfa9374b5b5d5de4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371943, "uuid": "e693d5fd-9b98-4f1c-b0eb-27f4fd390635", "value": "T1E72512086647F51BC82913354EE5F5B423AD4ED9A413D2273FDE2EDBBD32B568C80282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371943, "uuid": "744ecdb6-6951-455f-aab6-e35c2cc8a8bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371943, "uuid": "974bb3b1-f459-4813-82bd-b032f19c5ae6", "value": "24576:8fXy5EhUo51EGP+1sT/CuODj59sVBpEY:8a5oUo51i1sbCuO/fsnpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371943, "uuid": "25d42628-ba1f-4dc2-bc05-3aa74acf171a", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371943, "uuid": "b8257f05-356f-4ad0-8e66-88c2e4c1eb7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371943, "uuid": "a10a1a9e-0322-433c-86da-461e09069783", "value": "070964628f8a82b5e4f80476803a8f2838a7b5e8f51942679b88cc6c0378efcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52887aad-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371922, "uuid": "3acc3aaf-609a-41e8-bdeb-df0f56ff83d1", "comment": "Malware payload (AgentTesla)", "value": "a42d761e17a07aff3925b2a3ca47ba87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371922, "uuid": "0826e0c5-3364-42b7-aea9-08ad59e4e871", "comment": "Malware payload (AgentTesla)", "value": "0732e0d12001262cb9d9a9333c7f8bbfdde8db333287a829a2b80e08ab95795f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371922, "uuid": "3b152be7-17bf-4aa4-8c3b-12134e48b13d", "comment": "Malware payload (AgentTesla)", "value": "722156c6f1ae4f2cfde62afa6fd164bc525cc52a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371922, "uuid": "0641ba09-35d5-48d7-bfec-f0b75c9a98d9", "comment": "Malware payload (AgentTesla)", "value": "4f30e70b65214114f83ac7131d4d4d901c9c5d0701ce180c0f2af1dcb099c7ebffa8c5d42236292464884d46d4c995f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371922, "uuid": "3ab0e8df-f7ea-4ddb-bee1-0c3c94b4e614", "value": "T101252219A516E407C989133559F0F2B4177D8FCA9803CA13ABDC7EEFBA12B519F881C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371922, "uuid": "ba80db92-cd8f-429b-8c33-ca8d24fa48ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371922, "uuid": "9a2d6b41-ac5a-44ac-951d-20046d68da5e", "value": "12288:ATtZlJdbEMzxzTVyHnpXaZle5cff5iL8sqrQwBO2LLiz+YzA6CNKqgPhNXtBoSpZ:IjxFYpqwLjkM2LLiz46pfhBtp1KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371922, "uuid": "42c6da55-b2ee-49ce-ba9d-50001e52543a", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371922, "uuid": "0a7c2bc4-c65d-4f8a-a150-da1aa9b5bf27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371922, "uuid": "018a0643-b03b-4347-900f-628e008337fc", "value": "0732e0d12001262cb9d9a9333c7f8bbfdde8db333287a829a2b80e08ab95795f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e448aad5-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786371308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371308, "uuid": "0a9bbac1-e97c-4f1f-a83f-8e446441abd9", "comment": "Malware payload (RemcosRAT)", "value": "c132eac073a697682624f1497c490171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371308, "uuid": "e6fa0777-8375-4ad2-8e4c-65db1a6b89f7", "comment": "Malware payload (RemcosRAT)", "value": "07da7e987d4cd53ffb38b5601d29a393073a77892868dea9220c11de5fe95688", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371308, "uuid": "b9d73df3-672f-4b65-aa60-c7e0ac0ef3e1", "comment": "Malware payload (RemcosRAT)", "value": "863b03d8fee936347d593bf3cfcaaa931d549fe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371308, "uuid": "ac43ee58-3cc4-4cb1-a3b5-3a40ad30514e", "comment": "Malware payload (RemcosRAT)", "value": "e54f5f8a790ed3c2a6ae40b257a4264ae431ee4abeaedcb630568590ce50a8f42b4af07598eda2deea2c90ee4a25f878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371308, "uuid": "9626f7f1-24ae-460e-9421-4516ab004e1b", "value": "T19835F18C3501F49FC853CA364EA4ED74A6646DBA9707C20399D71EEFBA4D9878F140E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371308, "uuid": "d485c243-1580-48c2-b756-fb8cd5a665a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371308, "uuid": "75d4b084-e3a4-496e-b502-2a777fa52a1e", "value": "24576:h4g5uMnNt+GbqaAa4LmlbnxyQh42VWcoe:OzMnNt+GOxEhxDh42VWco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371308, "uuid": "8fd05c12-9c54-4d8b-ba41-7f1537981304", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371308, "uuid": "956a3744-0cc6-4678-a175-37b13fb8a7e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371308, "uuid": "cbdac0bb-ecfe-47f5-ba1f-09030d372251", "value": "07da7e987d4cd53ffb38b5601d29a393073a77892868dea9220c11de5fe95688", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b195e8-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368436, "uuid": "cd863d2a-7561-4c44-816b-7f6fe48afd6b", "comment": "Malware payload (Vidar)", "value": "83ddfcf91457f53235148588b54da288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368436, "uuid": "4d72c3b4-70b1-4ddb-b055-e091db7f80c8", "comment": "Malware payload (Vidar)", "value": "07e3a06c0f02a5064c3ea0f0ea5087d74a75ff4bec4ba316852aede75c2671c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368436, "uuid": "64fd7f31-46b1-489d-8d66-3df8a7cc551d", "comment": "Malware payload (Vidar)", "value": "fe89cd15e22cd4c4e7db930e9be62294f6f547f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368436, "uuid": "f20f8d9f-05bb-4193-a047-45a6b6428c72", "comment": "Malware payload (Vidar)", "value": "49141e1f5c6654a7a0bd4b64251877f8200dec1e720cb3146dbc010d1597b4c1d9628cd49ec20add7543ff1fde9de181", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368436, "uuid": "cef9c864-4292-4235-8953-977b65fbb01e", "value": "T17E323B9736A0E0FCC22DC53565AB21F27A5130441362E9FF33A589852BC7352F6BDB06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368436, "uuid": "719c63ad-1ae3-423f-8d5b-dbcbebe3e9c4", "value": "e489cd9c73beee1db4c320380f37924e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368436, "uuid": "a51b0b64-8f59-460b-8655-c80250bded92", "value": "192:OY88F6HsAiKE3cOtcMoSp54E08y9fHprpJFkXho2+jQH3Vqo+r:OYvWs7bvpZ2prrFMh/6Mlqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368436, "uuid": "b1152a8e-a214-421c-9853-4c74ae50b9e5", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368436, "uuid": "88eb54fd-c921-4487-90a6-f0ee2fff9303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368436, "uuid": "636b7a50-8fdf-4b16-a8b0-f5ab94a1c8f6", "value": "07e3a06c0f02a5064c3ea0f0ea5087d74a75ff4bec4ba316852aede75c2671c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea70f1a1-9468-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786331375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331375, "uuid": "a79da364-90ff-4ebc-9ab0-bd5eb8b7026b", "comment": "Malware payload", "value": "5ae721088de99dd626fbdae017940a2e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331375, "uuid": "cf29228f-8105-42b0-b3f8-a45d7d9c7425", "comment": "Malware payload", "value": "089cd860e127207b4a797f7ba06ffbff170c899ba79bde86287399b6fee02317", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331375, "uuid": "c07045ab-b1dd-4d02-a74d-d55290f6d67a", "comment": "Malware payload", "value": "9e2c1d4590a787798dcd90c3c780b2b864f37b59", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331375, "uuid": "62143202-9c8a-4cfc-b0b6-4bc2c223401d", "comment": "Malware payload", "value": "4ac742f81501139dae142051a3535a82190b7ba69f3e412d4a697088de0b4557e31241c2bc1f7f5b25bc8dc0ffef7823", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331375, "uuid": "ab0f0a47-4966-416f-8e84-dbcce9016784", "value": "T13AB6232BF78069E6E4A8813486C2F37063B2D51AC707C3572B6D12B5FD7E2941F89987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331375, "uuid": "8589c30b-06ae-4507-8427-7e698436875f", "value": "196608:Od5GATq6NYNQEOAgp3qfTWlVEEKwpVa67wLND6Mmh/J+5kL2:65GA2xNQ/rKWlulwpVYZDhmeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786331375, "uuid": "fd6202ce-e052-4b9f-a90e-08609318682e", "value": 10928867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786331375, "uuid": "afe9747f-bf8a-41c0-bbd4-b87b4fa90b86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331375, "uuid": "55bcfe82-70b4-4d05-8caa-198654e721a1", "value": "solo.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29eb652d-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368418, "uuid": "04556175-5806-44a8-a6fd-bd42a84b5904", "comment": "Malware payload (Formbook)", "value": "646179bac70c00f8a1ff4f5c70f09f87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368418, "uuid": "907578b5-957d-49c1-a27e-aa22b060f07b", "comment": "Malware payload (Formbook)", "value": "08ab8e89dd953a56cb1c443adc124b74edc3def3dc66a2e583b7a6c4ff9389b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368418, "uuid": "325f842c-55c3-4f4e-9082-7ef086ba3529", "comment": "Malware payload (Formbook)", "value": "efdb0a452deeb79c7f0d3abaa92acce29ae5d0ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368418, "uuid": "249a47cd-6ec4-4849-93e6-85ba81f8fcb5", "comment": "Malware payload (Formbook)", "value": "a449c4062bfec5aeffc259cfa36427d1894ea30c0b9f64784f431c406e9d2382fd466b57d3d8346235590237092d6ed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368418, "uuid": "cadd0ec0-70d7-42bc-a973-42d61b0a588e", "value": "T17C3501C03B757705EDB85A349939EDB642B92D69B424F8E61EE93B8B746C7005E0CF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368418, "uuid": "5f02e762-796a-41d8-a15a-dc20045df527", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368418, "uuid": "a762fc6a-77f0-4034-b9a9-7699c72b6962", "value": "24576:TSbwLApKvKGbLkT65PKyvQMEIUFe4JBPuAy+:G88pQ/bCpRFeetuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368418, "uuid": "00a0ef65-4a4c-4ce2-a7dd-bfc74f5bf222", "value": 1078272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368418, "uuid": "fbe180e1-043a-424c-bd34-36a9b3112bbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368418, "uuid": "66dc454c-8a70-4a15-b898-d0102724501b", "value": "08ab8e89dd953a56cb1c443adc124b74edc3def3dc66a2e583b7a6c4ff9389b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ad81ac-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786370616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370616, "uuid": "e4c77069-8aae-4625-8d32-405025796dea", "comment": "Malware payload (RemcosRAT)", "value": "a85d5d9bf0ae5c206ad939712433ee73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370616, "uuid": "966fdc57-eca3-45de-86f7-c9de5a6477f0", "comment": "Malware payload (RemcosRAT)", "value": "08ca84e4ba5b01af8f284ad28c307c2ffb0fcf7c6f6f98b69bc2552ef286d235", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370616, "uuid": "f14fc874-31a0-4a81-b3b2-f41819223cec", "comment": "Malware payload (RemcosRAT)", "value": "3a9fc55909c3b903f193fca48c4a0f0be1d106a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370616, "uuid": "3e437f0e-0510-4fd4-8700-e235740bb75e", "comment": "Malware payload (RemcosRAT)", "value": "603c4899954a70ce15216d942fb58af96a5f610bd8fdc003324d54b1de2d32bce1d1a2c88452e15bfb580732d3c25d9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370616, "uuid": "1a5fd18f-6e48-4418-91d9-02a76e536e08", "value": "T15165E0122DC76664C7AB5BB8C166049823F0AE0742E5E35E2FDD61EFD9E278DC9050B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370616, "uuid": "08ea55b3-195e-44fd-98b4-ca170d100d5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370616, "uuid": "5812d05e-ef1f-4a05-a049-dc4dcc0ec39b", "value": "24576:C50jhwH7krKlGwo9usMAPz8C2vNO1Q+m:gewHsgGWxFKQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370616, "uuid": "d9029306-b6da-4359-bee6-023b0800d499", "value": 1528832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370616, "uuid": "feec5fc7-0811-4166-a4b4-a1ca2b5e8f05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370616, "uuid": "e8aa25f2-b228-485f-8b65-0d4680e7a2a4", "value": "08ca84e4ba5b01af8f284ad28c307c2ffb0fcf7c6f6f98b69bc2552ef286d235", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8408c9c8-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786369428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369428, "uuid": "8418553e-12dd-4d1f-a288-6936aa9042fe", "comment": "Malware payload (RemcosRAT)", "value": "de9c9f41a10cc497fb410eb94df61bda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369428, "uuid": "121dc910-392c-4fdc-8290-1793a1e58ab5", "comment": "Malware payload (RemcosRAT)", "value": "08e9ee91c55772b2c30f2ca6d26b9960000f3b08d08bf878d5d95045c93fa7c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369428, "uuid": "a540a2fa-0e84-4e2f-a6cf-5261b8bffc7d", "comment": "Malware payload (RemcosRAT)", "value": "fd8f0e2ac7433deadde4b7cb990d59f0edd7b855", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369428, "uuid": "845abd10-8767-49e2-a5a1-d5f58e0eedb1", "comment": "Malware payload (RemcosRAT)", "value": "e435617ba621873fe5f406f5ef261f6ed6ce3ff9bef44c3c4c3f870a737a19203be48d603340618117df4c931f137108", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369428, "uuid": "11cfaa01-f929-483e-aa98-cfd74c2185ec", "value": "T1C5150164A74DD406D4214B381DB4E27C0AAD2E9CAA21C3675FDCBFDFB5B27064C493A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369428, "uuid": "bb550ce1-9149-443f-8b2c-b88d41baba70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369428, "uuid": "75d6a65c-d44d-4edd-9c78-e1a8716f0a43", "value": "12288:64gBwwZjCrUAJK0fjKDWSQM1nh9bTiO5RQogkU4Wo8YLi1hoNat6NZVXEcOzyO:zUr0fjaLQM1nXTN5yhiOhcq6vV0Lx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369428, "uuid": "88e8ccd1-1be2-4e23-9957-0d9d589611f6", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369428, "uuid": "99b78aa7-0463-4bab-b1f5-d984517f39db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369428, "uuid": "f72bda0a-ffea-4431-8858-3eeb551cc318", "value": "08e9ee91c55772b2c30f2ca6d26b9960000f3b08d08bf878d5d95045c93fa7c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91de489e-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373747, "uuid": "f084d69b-ec47-4905-870d-f634612f46b8", "comment": "Malware payload", "value": "38e7825de04bbc9621156431efbec8c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373747, "uuid": "a04ed16e-9b92-49c0-ba87-9d88ee776139", "comment": "Malware payload", "value": "08f5afca1ab3339d6a07b21d8bb69d947755ad20edded7f7cb38de8b336e35fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373747, "uuid": "a29c1739-9735-4a6c-a21f-48723c12bdb3", "comment": "Malware payload", "value": "6b7d86fa064ebd1b4c4d17cc1cbfb5b54bb3e9e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373747, "uuid": "b69571fe-85f8-40b6-a00a-1b6de040761d", "comment": "Malware payload", "value": "16b3119159f426360657bdea6b091071013d1bb3fdf72271d77dcd795fbbb0f3ab3e78466e80746c0652b377a4c528f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373747, "uuid": "c6f318fe-d0e2-429c-a311-9de42251b8d3", "value": "T145F57C27F7887D3ED46B0B364A37C690983BB7627A128D5767F00D0C8E355942E3EA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373747, "uuid": "88847e2c-f9d8-41ca-a8c9-057c0eb32314", "value": "7c77b89cd344508d2ca812dd1c349c70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373747, "uuid": "c904dd03-f5d0-40f4-8bc4-e48d6b96cc31", "value": "49152:XPJwSihjOb6GLb4SKEs3DyOMC2DlUt0+yO3A32ASNTvzlzlneJejyw0Fq:BwSi0b67zeCzt0+yO3kSh1wJejyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373747, "uuid": "6e54b13f-908a-4b96-8b1e-1b7bbcb35395", "value": 3491840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373747, "uuid": "72af235b-7c49-4b23-ab14-b91033a65628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373747, "uuid": "d01fd5fd-0c96-46fb-8053-80bfd91fc77f", "value": "08f5afca1ab3339d6a07b21d8bb69d947755ad20edded7f7cb38de8b336e35fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7b744f-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369010, "uuid": "8d2a349b-943c-408b-8a53-62b4c3a35178", "comment": "Malware payload (Formbook)", "value": "26254aa8ca84f1737b7f2f28f9079e20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369010, "uuid": "3f5c674d-9a2f-46be-b7ee-81fb6b5c31ec", "comment": "Malware payload (Formbook)", "value": "096c48b0ee06c15d38d34b95feae0c15e21400f793c436edd8e169b119b10436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369010, "uuid": "add61a93-2c17-437b-955c-b4cf717b68b8", "comment": "Malware payload (Formbook)", "value": "86b23b5e839595174482d9cd437af238c40f22a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369010, "uuid": "3ec2de2c-be6d-416a-96e7-067ed5ff17da", "comment": "Malware payload (Formbook)", "value": "0329dfa023e854e7141dcecc754921185b4f4bf9ded1114a468e86d268bd0676e6bcbe5360b055151866a16c46862d9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369010, "uuid": "3190e65e-19c9-4acc-9300-2657bc8f37d1", "value": "T1D4351218264DDD06D0A20F798A72D7F81AA42F8CF421D307DFD9BE9BB67B6D12844352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369010, "uuid": "62398395-14aa-4a70-9eb9-ee6620045e35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369010, "uuid": "c6252974-9447-4c22-a06b-0abc7c068083", "value": "24576:ma6UwulyXuwM68CL0B0/lQVNIfjsFk+gDe0P3QMzlO7O:ma69ulyewM68g0B6QVNQ3lD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369010, "uuid": "f61a795d-f20b-4210-877f-e57ac88a60c5", "value": 1077248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369010, "uuid": "1ada449d-0e41-40b4-8ec5-3ea721535cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369010, "uuid": "605abe8f-b0e5-4a32-bb6d-cb561819a05d", "value": "096c48b0ee06c15d38d34b95feae0c15e21400f793c436edd8e169b119b10436", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "572c8ec5-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (a310Logger)", "timestamp": 1786372360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372360, "uuid": "ac9609d1-7e7f-4dd6-9db4-3c307c9cae36", "comment": "Malware payload (a310Logger)", "value": "c1f26136f8be1264bd9ca1b7f81eee0e", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372360, "uuid": "81656eb6-cec1-43c4-9c42-f5df6b64e654", "comment": "Malware payload (a310Logger)", "value": "09a6528de56686a9c7ed4f4d1ed0642e94071b929a8d11a2a0220896f24daa82", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372360, "uuid": "001790cb-d2dd-4cbb-ad53-51a6cec1893c", "comment": "Malware payload (a310Logger)", "value": "3c7947cfef4219325a93221dc33368f0d72d118f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372360, "uuid": "5924d801-c7c7-431d-b176-8014fd93b601", "comment": "Malware payload (a310Logger)", "value": "ceda4afed6aec4c262207f9f914d17d46a2acda6cfefb3a352b1718c5154e84c4b39ddf0780f478f747a57f158bfa808", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372360, "uuid": "74ddaa60-e72c-44ac-a894-46cad685c41f", "value": "T139944A13EB60A01EF1A389B0B9B5925A68267D351B98EC4BF3409F5A35715D3ACF031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372360, "uuid": "b7e82fa4-1662-4791-9357-489acbb60333", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372360, "uuid": "b275ef86-b619-4d42-9839-939aec09c745", "value": "6144:Ee8d1/w5KA81IJ8GpF6nuTmOOUiBUrjIBg58zNCQWFiuSxcbykxCX+D:8jYKkJj6GmZUiqrsJCRpbykxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372360, "uuid": "7e9203a6-c138-4f35-a9cd-b2f3b7d901a6", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372360, "uuid": "3e33678b-d481-490a-adad-255627918d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372360, "uuid": "2f8266b8-2e3d-485d-8453-64a954f9e3d9", "value": "09a6528de56686a9c7ed4f4d1ed0642e94071b929a8d11a2a0220896f24daa82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a55bc13-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369359, "uuid": "d89671b6-07fd-43e3-8ac5-a1092884a582", "comment": "Malware payload (Formbook)", "value": "32eb0b440a70875f180b03f1d50cce9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369359, "uuid": "1b5eb21d-39ef-45eb-875e-5cecca102cfb", "comment": "Malware payload (Formbook)", "value": "09f1444f8922e986eec2b7b0e071e0cfea879a953cd612c4711dfb4b7c5ea744", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369359, "uuid": "47b5d82d-7221-4f0b-b60c-5b3fd210082a", "comment": "Malware payload (Formbook)", "value": "ff25e896f5f25811f0f79ddda7e9efd830904d17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369359, "uuid": "cfeab211-01a3-43cf-9110-0d45ae7c29e9", "comment": "Malware payload (Formbook)", "value": "162e10a09ec0e71d8596ae9df25e593622609764d5630567438a603c8b2499aed32c386dd57151608969d83dd2d2bb38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369359, "uuid": "76e7bc5a-4cff-4e52-96bf-15707918e555", "value": "T1303502186368DE06C46A237459B4C2780B748E1AFA11D3179FE8BEEF7DBB7124C19247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369359, "uuid": "8e2e21d7-9eb0-4081-b698-72d4872cca83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369359, "uuid": "cd685147-48c5-44c3-9367-46c5159763df", "value": "24576:5ATyQgQ0+puNBG1uL8mdyHzOSLgOqOqADisuANvV0LVX:5APgQ0+puP/83vqOqA+sfNN0LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369359, "uuid": "68faf7a3-3ea9-4e47-bff1-7a4c445f6c38", "value": 1152512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369359, "uuid": "41bb24cd-800f-468c-889f-51b12434d540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369359, "uuid": "6bfe5208-5c9a-469c-b03a-38be71575c88", "value": "09f1444f8922e986eec2b7b0e071e0cfea879a953cd612c4711dfb4b7c5ea744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fff0488-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mallox)", "timestamp": 1786373556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373556, "uuid": "132bea31-281b-4fbe-9343-cfa4f87aab22", "comment": "Malware payload (Mallox)", "value": "fc39b8632c13702c93a374c35ca0ff69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373556, "uuid": "a31d722c-874c-46d4-aba5-0fe38e771f41", "comment": "Malware payload (Mallox)", "value": "0a26eab06e82c211b5e8c44599e481bc9a8360ca75e5bf3aa1540d1b075643f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373556, "uuid": "4af5492a-9cb1-47e9-a47c-412d6efea7fc", "comment": "Malware payload (Mallox)", "value": "f3534ffcd3fc8cca3ad8ebc1e15d22eed4ada415", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373556, "uuid": "a4af561d-e667-442b-b728-b87a07a26a5c", "comment": "Malware payload (Mallox)", "value": "14f9ab011486f45e6021b19e9902731d210efa7afaf74f629ecbd3ac6193c0ebb8dbbbb70ed7419545614083823015ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mallox", "colour": "#4D554B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373556, "uuid": "923dcdfe-5d89-423e-ba5c-61aac36bdac3", "value": "T125247C0675D22EBCC416C07492479922997678080331DDFB23EA6A343FABDE29F3B715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373556, "uuid": "dd079ab5-c343-47ce-9f53-f3ba6e605017", "value": "304f13e4e8ec4ee68e46bda734dfd40d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373556, "uuid": "f410e575-6262-4ed6-a0d2-ab4bbc80fd41", "value": "6144:/4gS/pUMV+m8+AvBWro3sCilsiNKUEza/:gFV+mivY4iVNKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373556, "uuid": "1dea8eaa-7a23-4ea7-89a7-51fd7822b59d", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373556, "uuid": "f70307d6-8bf5-4210-987a-802af7f416d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373556, "uuid": "f36fd92a-a476-4025-8f87-aa0ff4488ba0", "value": "0a26eab06e82c211b5e8c44599e481bc9a8360ca75e5bf3aa1540d1b075643f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b3501d-944f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786320353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786320353, "uuid": "d7b84786-e1a8-4773-95b0-e180e8876cba", "comment": "Malware payload", "value": "9380b0cef1b1af5e53f4bae55392404e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786320353, "uuid": "b5fdfd24-a4bc-4c9b-ad9b-441fee7b1ac4", "comment": "Malware payload", "value": "0a3e9686877a670b85b55c614b53decbdc97988605ac1c2fdcf2b56e25e080c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786320353, "uuid": "8e1eaa58-df49-4569-8129-29051c652a10", "comment": "Malware payload", "value": "f2a34ff72fa8f13ca322cadc9a1f2e36dfb5de54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786320353, "uuid": "b28ee658-84cd-47fd-af5b-634fe68ab9a1", "comment": "Malware payload", "value": "214b531525893575463e6c5a3e293b4685d29a37b9d68a3151bb6181c9f50e0f43fd3e8a2a0dbbedcdcf5a11015d40ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786320353, "uuid": "095cc5e4-a261-41a0-a5d8-edd1e726dfe4", "value": "T19F857E57F2B400B9D4A7C17989471907EBB278061774E7DF17A08AAA6F23FE1167E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786320353, "uuid": "aeaaebda-94c3-4008-804e-9f927a457bf0", "value": "bcb151cdaa5a26bccf82eb41d5b5df24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786320353, "uuid": "74f68789-525d-4d48-b794-237064ea35d6", "value": "24576:p1nCWu7ciCJKB0YETD3nUKbewsTqC6Yu4RZUmDXQ6Gex7gYbdgNgIaH7h+skNIBO:p1Hu8RYEf3nUzu/a1DXMgIaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786320353, "uuid": "78d7a29a-163c-40fc-a472-6551de3a7560", "value": 1821184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786320353, "uuid": "f383df77-09b8-4938-ae67-07e00cbc610b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786320353, "uuid": "eaa3bd2b-fd8f-41a3-96be-5d8aed72f657", "value": "PFTZZN.478.dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0291624c-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370500, "uuid": "cff80379-6a13-47ee-a286-c14b2d747f26", "comment": "Malware payload (Formbook)", "value": "37d4d53b7fa928f4a3f000002ce9f734", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370500, "uuid": "832ed743-4fa9-47c7-903c-2d912e02085f", "comment": "Malware payload (Formbook)", "value": "0a86c64e79af15ff094baad609d9651eb51e382c817498d44b2df82005fd3f1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370500, "uuid": "8a9be149-4b26-4858-96a2-d0f59c1e16fa", "comment": "Malware payload (Formbook)", "value": "708c0fbe63dd5f133ed5e1feccc0574eff33a6ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370500, "uuid": "53d9558b-76a5-459c-9168-03b1e898122d", "comment": "Malware payload (Formbook)", "value": "23b21618620a4203a79b96a389be240473db036103d53a56c1addbfb2ceaa7f677939e219c48b3051c28e3122c17e337", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370500, "uuid": "fb940e74-1150-4968-b087-98e6b2756893", "value": "T13B3512B06AADC821C8E247754A91E33842F86D85E920CB135FECFDE73976B076850B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370500, "uuid": "3c01ed07-a474-49ea-828e-779bd126b945", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370500, "uuid": "b96dae63-7cce-4c06-a272-decf1109eb56", "value": "24576:TTHp4rAVMxtSFSnaf/8f49GaY+jAmzPJZHHS5w:fHp4rlxIFSZoGaYyAmvHHSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370500, "uuid": "b727926c-366a-4436-a619-e6bf47cb6213", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370500, "uuid": "bfc4813a-8f1d-4555-bbc4-117ef4670ffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370500, "uuid": "c851adc4-d277-47ba-be49-53a4403c030c", "value": "0a86c64e79af15ff094baad609d9651eb51e382c817498d44b2df82005fd3f1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf22f59-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368742, "uuid": "cb7bbbb6-7f3b-4bae-b1c9-b1edfd1a9d07", "comment": "Malware payload (Formbook)", "value": "be83468521645c57f267a93673c7b090", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368742, "uuid": "cd5c3b2a-eefe-4aba-89cf-804083f65c10", "comment": "Malware payload (Formbook)", "value": "0aa3ae39f4a3f4a840b6666201ddfe6bd288c0d33ddfb0a12d8de7e929b0e7b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368742, "uuid": "1303dd86-38fa-4d62-b8a0-ca081153c3b8", "comment": "Malware payload (Formbook)", "value": "358c790c4b86fcef8265a8fdb733ce86f941e058", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368742, "uuid": "65ae48ec-e084-4637-9d19-f3039a22d902", "comment": "Malware payload (Formbook)", "value": "1abdb7776fe9545062cbdd7b2987bcd0c0c7585880ba266b69ae9cebe38d2d0e3f9661336f018b1433a641ba9b761175", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368742, "uuid": "43976c92-37e3-46b1-8008-fe77aa69d91c", "value": "T1542512542AD9CB95E0A647B81AB2E37107757C1AF620D31ACEFC3CEF3961B00256476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368742, "uuid": "9869e31d-3de8-4818-9aef-c7f9c038a7d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368742, "uuid": "84b44243-8a56-4766-bffc-56da8acdc101", "value": "24576:kpYwJcZrdau288i2MPYCgjMLSFQmbkke4h4dPFdNQ4:qYwJY28528ngjMLDmIv4ePFdNQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368742, "uuid": "76308b19-7087-4caa-9c83-f86b39da265d", "value": 988672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368742, "uuid": "c0acf082-7efa-45af-820f-63234b3e3408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368742, "uuid": "495f6f37-7557-4b03-968f-ecb31630c745", "value": "0aa3ae39f4a3f4a840b6666201ddfe6bd288c0d33ddfb0a12d8de7e929b0e7b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c971b290-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372122, "uuid": "aee1d4b5-75d9-4a7b-8fd2-30937aca3ff8", "comment": "Malware payload (Formbook)", "value": "3a5d6bffa0cc6f813a4cb892abef72da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372122, "uuid": "99e09f8a-2933-4e2d-bc52-39a0e9a368c5", "comment": "Malware payload (Formbook)", "value": "0acf3ab0676daef69a718b8d7d3e8888ca5d4d3d5e4c7963f72291838f61f05e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372122, "uuid": "e2b77708-b867-4be7-9bb4-1d1ab08de796", "comment": "Malware payload (Formbook)", "value": "6adc4ec934e15e08d3945fb66b0a6a76a250ec11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372122, "uuid": "59b38483-a173-4bfc-9ae4-05bd9746cad0", "comment": "Malware payload (Formbook)", "value": "5946370c13d2d3974a921dc217b47875401cb9231d557e24c417b82a890456460e6ca696250f4a0b91ffe08819794167", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372122, "uuid": "ff3ddf35-16dc-46b1-aa1b-74358989204a", "value": "T1342522A863A6DA16CBCB47B91970C338037D9F9DD421EB078DD8ECD7F52A3016A69740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372122, "uuid": "10b8e797-bef3-4a9c-b550-4130b8ea7591", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372122, "uuid": "113ec6d8-804b-48c4-a760-56608de63ed0", "value": "24576:/j/Og3bpWj9wqH5LUMGuTZX2iOpEDqh+N1yT2qCoI:rPrwjtSMGuTZBOpEDZvyT2q6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372122, "uuid": "468607ed-8706-4b35-8ebf-f45d0ce82695", "value": 1020416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372122, "uuid": "c2cb6986-4870-4cf1-b37f-fc26f6be4efa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372122, "uuid": "a17ed945-7975-4f53-a28d-c30b68146717", "value": "0acf3ab0676daef69a718b8d7d3e8888ca5d4d3d5e4c7963f72291838f61f05e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ceef905-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371403, "uuid": "45856721-0271-4a2c-9b4b-c92dfdad893a", "comment": "Malware payload (Formbook)", "value": "95e5dc046bf82e353f23fddf0a3da303", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371403, "uuid": "b5a4681a-5049-4e87-ae8b-a628f8138cdb", "comment": "Malware payload (Formbook)", "value": "0ad8902d47dbd13f6395d2c6b86d37dfebf166098f8ca6c1aee5d948db82d168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371403, "uuid": "a35ae4e8-f8b4-42f7-b955-e70c7c77f3bb", "comment": "Malware payload (Formbook)", "value": "511528177c62e3712d6dcebb2e349da9ec23cf7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371403, "uuid": "26091962-360f-4de2-9206-1072b7351976", "comment": "Malware payload (Formbook)", "value": "5cad24e728e7c15ac5a7cce06a5158731010b7a6b5d469cb9f522a4b9501709b35347e36cab016fef643f12a68d5517b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371403, "uuid": "f9659969-bf59-482e-861f-6a0793a5fde5", "value": "T12B2522496788E907C952633D0EB2F3B591EC2CEDA801E3675FE9BEAF3E369450D04152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371403, "uuid": "5999a6b1-e4f2-4e62-a5d5-555a314ebe4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371403, "uuid": "6dc2a124-5de3-4566-bee1-b418e1a3664b", "value": "24576:W+ZSQeqUqPhDU2a+AZxpCg579MZPAvbMzk9d:WySbWPhDUFXeZPjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371403, "uuid": "0ad06fde-fb85-4746-bd5b-97cf3736f4c3", "value": 1036800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371403, "uuid": "7e8709a5-d744-4df6-81a4-adbe7ddc6875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371403, "uuid": "aa2f0627-e290-489b-b88b-034b5d168383", "value": "0ad8902d47dbd13f6395d2c6b86d37dfebf166098f8ca6c1aee5d948db82d168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75294580-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340198, "uuid": "fbab27a5-1b1d-4fa3-a622-92ce4c58fb81", "comment": "Malware payload (Mirai)", "value": "00402cc9da1dfe2b811de1f8c0706c1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340198, "uuid": "a000f78b-ea8a-4769-af08-52ef748eb550", "comment": "Malware payload (Mirai)", "value": "0b4ca73e31710a1798b96a479127df657bab65481885aa9554371771b711bd0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340198, "uuid": "29024081-5727-4581-afc2-7d5943f37301", "comment": "Malware payload (Mirai)", "value": "79260401814bd4675e773407f8ea2ea274cf862c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340198, "uuid": "5708756e-9285-4c94-b59a-ad105b39d2be", "comment": "Malware payload (Mirai)", "value": "bea741bddee03edaa9f66869a92ce16d9f3cc65e5fd36cf043d2abd8231ba9366dde5507884fd688e9a97731251d829c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340198, "uuid": "c1f8db2c-0e13-4d2d-8f86-3b2cb98726fe", "value": "T16B842B48A3F0D3DAD1A9ED70233A3F1A9BA6062630977546211FFA6313B21750ADDDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340198, "uuid": "1db48599-5b68-4cfe-8256-a169e959b7b8", "value": "6144:ddHOWACKtuz96hwOlu1dd7hwyHpkVocCXdXmoN:ddHOJtK96dsF7hwyJyocIXmoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340198, "uuid": "e09a52cd-e3ea-4d25-b979-bbb7df18b73d", "value": 407824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340198, "uuid": "45fd770f-ed73-4531-bfe5-076218032588", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340198, "uuid": "d703e96d-a7cf-4e13-84f9-257bc0ba154c", "value": "pid.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79581b30-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786340205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340205, "uuid": "5ad60167-d726-435d-b030-ad74409099f2", "comment": "Malware payload", "value": "9ac966487ee66ea93b5b5c749c6c8777", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340205, "uuid": "9fbb295b-5b2f-40ef-b9e5-95ab75ef9cfb", "comment": "Malware payload", "value": "0bab7521b5930f90cb3c693cc71592e369b654a417c166b60971e7177c306a96", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340205, "uuid": "ed15add3-9a51-40bb-a5bb-1e5b9cc0acf9", "comment": "Malware payload", "value": "1c4eb2a84222ef824434e7ad87766e2472658f84", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340205, "uuid": "8b877550-d57a-4ed9-93e9-2948af287544", "comment": "Malware payload", "value": "7fdb7d2539a6c335b4dce80559de145636df660158c5b9d100317fe546776b423ea79d1fcf3019c12e6c1b06e9913e57", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340205, "uuid": "3f490b39-d376-49d9-a994-d859a4de239b", "value": "T1A501CCE5B828D2B07D4E9D2AD5DA0B8584410C3B11A53ED4512A6DF6861C608E10DAB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340205, "uuid": "c8f90b02-45f3-4141-84de-c5d26f76449e", "value": "12:sTlohbtQAr1tX0JW2F/hKypU+/jEpN8uJpN8uepN8uqFsftux5dyYpM80v:sTlUbSAhSZFpU+7EpbJpbepbqYux5MYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340205, "uuid": "2e01ca82-053b-4132-bacb-a538ef140219", "value": 851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340205, "uuid": "2fabf2db-3357-47bb-ac10-07fbf72d90c8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340205, "uuid": "4fdb1440-14a8-44dd-b3f2-23cc48d7a662", "value": "run_adb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1ec67b-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370868, "uuid": "c3948cf3-d55a-4586-874a-e20f1b92fbeb", "comment": "Malware payload (Formbook)", "value": "068ec306c716a07d090962917bacb7d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370868, "uuid": "354bcdab-6059-497c-ac7b-e4da548cd9f3", "comment": "Malware payload (Formbook)", "value": "0c2a64ea107f2062205b156046bc4d32faaef572f717c7964f2cb35a1ae6809e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370868, "uuid": "24866e15-9b11-44ac-b696-a3f229767e76", "comment": "Malware payload (Formbook)", "value": "f89ec91e12d8273c0cde65813828da1317b90451", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370868, "uuid": "21497a21-ebd7-45af-8200-2b01971f92ab", "comment": "Malware payload (Formbook)", "value": "a4629cbbc5903265da867752cd838e160e6ed41d1a5e880abe24b620516ad82f35e4e07e1e5ad5eb80d7e2d6a9838c12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370868, "uuid": "bb628541-0178-45b6-85df-85b5b1022876", "value": "T161350248320ADD06C6D25FB11E70E3B486B84E94E910F313CEE6BDDBB97A2963D552D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370868, "uuid": "8226afa0-5b09-4983-b0cf-7aee28c7646e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370868, "uuid": "5febc3a5-4651-40a9-8006-cff545552081", "value": "24576:C7R6pFxTm4pNd+uBrGRGaookTGY2s6kD+LzpfMtG:ClibTmcN04rGHook96kqLzpUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370868, "uuid": "0246620f-fa1e-4664-bf6e-fdc6223bb538", "value": 1097728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370868, "uuid": "a88d9baa-a367-44a9-b780-8e5b3126d657", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370868, "uuid": "12b2e39d-07a2-4a97-b25a-2c5092848132", "value": "0c2a64ea107f2062205b156046bc4d32faaef572f717c7964f2cb35a1ae6809e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3b7949-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786368857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368857, "uuid": "4de61ebb-14ca-4bdf-b7c0-0e9a2c8bab7b", "comment": "Malware payload (RemcosRAT)", "value": "d93ca0f00ebb5449d0e94712f75470e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368857, "uuid": "13a63e7c-d03a-4313-b667-ed011f8fd09e", "comment": "Malware payload (RemcosRAT)", "value": "0c3a63f8f91965db6755ea623fe109ee291dbba63dda3022b1a22a9640bccee9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368857, "uuid": "4f4a4f33-c7ed-42b0-9ce9-b02140cd0008", "comment": "Malware payload (RemcosRAT)", "value": "7d1e582d062fd54eb3b9815ca45b9f0d7f4760f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368857, "uuid": "7b402ace-9e51-4093-9f5e-469092e66ed8", "comment": "Malware payload (RemcosRAT)", "value": "ceb64b70cc5a717f731b5890bc905f44f3326fc422940f6da426819e9b0ffc61f78109421b1b3c156a5b9f37075e6c19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368857, "uuid": "163caf87-1506-4d56-8ef0-82eb8b0d55a1", "value": "T17CF412A427A8C751E0F617F11AB6E37243707D5EAA15D31A8EEEADCFB831B005618743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368857, "uuid": "5ca15376-0022-4393-8712-e4960f43b91d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368857, "uuid": "0f35971f-6553-4b93-9440-c1401239ade4", "value": "12288:t8/HiNbnqjOwqTcYUEn+Sj1FV9f/0mWIAieTD9QsQxYfu2FTl8Y+8gzhLc4:tGcn8Ow0cc1FV9f/0MAikD+s3Gcb+8gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368857, "uuid": "b929a280-bff8-4db6-b326-02e7b2f0af54", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368857, "uuid": "7be212ed-4008-4d18-932a-089af4a68cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368857, "uuid": "bb2cb79d-2a06-46d8-bd03-4d619a086773", "value": "0c3a63f8f91965db6755ea623fe109ee291dbba63dda3022b1a22a9640bccee9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bebe7484-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371245, "uuid": "890392cd-4f4a-4ea0-807f-0867e72257d7", "comment": "Malware payload (Vidar)", "value": "3989f639bc6cc32c1f95fa1dbdd4825e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371245, "uuid": "93be2295-4f06-4444-93d0-e51fc2657333", "comment": "Malware payload (Vidar)", "value": "0c725e05e60ba16ff566d9201510a6bcfdadede5baeaebfebacd9219f2abe89d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371245, "uuid": "1dc8fb33-f843-4dd3-b925-05c5ac771f11", "comment": "Malware payload (Vidar)", "value": "6403217a69e4eeb9600dcb526fb7fc879afb0eab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371245, "uuid": "1c0ed210-b2f9-4353-b195-aa017ef9811c", "comment": "Malware payload (Vidar)", "value": "d8c691e115bdfa83922515445584ed73acc300394f6392ed9dc4ff760f4ac203ff1250d91feaec5f61649a49352a5c4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371245, "uuid": "297ef240-5585-4c6f-ad8d-b3f1bfe0a9ff", "value": "T18652C75672EA60B9C1FCC3BDD94A16F7CF163092230E1EFF05EE81A467C2151A9A8B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371245, "uuid": "d27f9271-1a7d-45b3-a995-239cfb936b84", "value": "4b0c36d710a9f321af707a3125adb015", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371245, "uuid": "04e055fa-57ff-42ac-af96-a6def50d20ff", "value": "384:QPmpWl8QonKQcxeVlqGXTAlSCCdMuUGmPlw2:9WCUwlqGXMlSCCMLdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371245, "uuid": "b6411bec-5653-40f0-a4dc-13e6f5911cab", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371245, "uuid": "5ef34dc1-9c9c-4517-8903-60630b30a692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371245, "uuid": "2781de04-9922-4e80-95d7-a4f2c5c7c0ea", "value": "0c725e05e60ba16ff566d9201510a6bcfdadede5baeaebfebacd9219f2abe89d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5dbc36-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AndyDesk)", "timestamp": 1786371857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371857, "uuid": "12ea1ff9-b83a-49ee-af57-9ccef2385851", "comment": "Malware payload (AndyDesk)", "value": "b17611e8bdfaa73ec4c1f3e768ef3385", "object_relation": "md5", "Tag": [ { "name": "AndyDesk", "colour": "#5D99FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371857, "uuid": "1beda37f-67b2-47d2-827e-d55199380652", "comment": "Malware payload (AndyDesk)", "value": "0c80befb0b31b46f1f0a030af4aef3056806e474eafa8796220056406947bc13", "object_relation": "sha256", "Tag": [ { "name": "AndyDesk", "colour": "#5D99FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371857, "uuid": "38eb30e6-89b2-4154-a753-6bcb344daf13", "comment": "Malware payload (AndyDesk)", "value": "9a6dcdeffa448bbcef1f2773c7a3d990ebcecf37", "object_relation": "sha1", "Tag": [ { "name": "AndyDesk", "colour": "#5D99FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371857, "uuid": "0bd6b08d-ae6a-4d61-ab0b-d4115d627104", "comment": "Malware payload (AndyDesk)", "value": "76bbc5d96a901d5dac4c7955966725d6555b6edcbfc122012016656a8b58d55cf9577f2ea5c49a4b16032df702194b9d", "object_relation": "sha3-384", "Tag": [ { "name": "AndyDesk", "colour": "#5D99FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371857, "uuid": "573cca96-7ff2-43d7-a81b-b4a9b6e8a85b", "value": "T1BFD48B10B102E2B1D9021671C893EFF96525AECBD62D84CF67D9FF14BA722D2D01E24E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371857, "uuid": "eb5533c6-4174-491d-94b4-78e79052e3cb", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371857, "uuid": "9776e714-3d02-4bb3-aad0-5d4ac3790a5a", "value": "12288:gANwRo+mv8QD4+0V16cSI5m/eWzUQj89lb6x9xIerCbR:gAT8QE+kiam/eWzUU66hIeraR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371857, "uuid": "d82d8341-6b02-405c-a6d2-3ab388308ff0", "value": 612296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371857, "uuid": "3d773bf3-d222-41d4-9b1f-74e5d6fb872a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371857, "uuid": "4cb614ca-491c-4824-b394-593ed8b264a1", "value": "0c80befb0b31b46f1f0a030af4aef3056806e474eafa8796220056406947bc13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b32734-9460-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786327710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327710, "uuid": "31c1eae2-12d5-4d1d-89b8-0b67fedc85ac", "comment": "Malware payload (Prometei)", "value": "60afd5c2a771fd8fc1746717e39bcdbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327710, "uuid": "8d6de918-21ca-452a-9706-d27cfbd17072", "comment": "Malware payload (Prometei)", "value": "0ca3a4c2800f9454cdcbb8398a7ec97b00f90f4234c7c5e48e206a8352d86750", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327710, "uuid": "5417ebce-4381-45b0-ba47-a088aa47e737", "comment": "Malware payload (Prometei)", "value": "96bb1c2a720716a05f876ef280b8d904c53396aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327710, "uuid": "38b7b7c9-b1db-4f8d-b790-b836352c7c9e", "comment": "Malware payload (Prometei)", "value": "c5ebb126ddd97097589d1dc8c9bf6b0490c73effe53a3e321a616ffc97ae8b1e535320c1814f39f70f543fe0c50fb6d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327710, "uuid": "7f9beb94-0701-4a74-b24d-ee06a1571552", "value": "T1968533FA241A6056C502F8A737BA36E2960D6CB52DDCE09FD4CED4A61A3D5EE4F103C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327710, "uuid": "3cc4b76b-5d68-4137-9319-42373e82b4c2", "value": "24576:U5EPwlAml7uAKqU0zhb20eH5YEdA85xYsP3zRqU9MNvYbvNspKu5Xfuwd3vjMxmS:kxOmVyn0k5YEdA852Ez0WKgNsJmwlumS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327710, "uuid": "4f8947cf-1233-4adf-91de-68987042093f", "value": 1750956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327710, "uuid": "106e21c2-6039-4a83-b584-b049c19098b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327710, "uuid": "95676671-ab0b-4043-8030-45e227dfca0e", "value": "0ca3a4c2800f9454cdcbb8398a7ec97b00f90f4234c7c5e48e206a8352d86750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1a9b89-9469-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1786331750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331750, "uuid": "3260e7a5-4532-4c46-aa24-6376f61ac184", "comment": "Malware payload (Gafgyt)", "value": "38ca7c8dd35148f1ecbb2c3714c62fa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331750, "uuid": "3a4e1e87-f442-4c59-aace-95167efca83d", "comment": "Malware payload (Gafgyt)", "value": "0cbf6f10c9a39d628bb5c0a3810f25d2f58b37a4351045ab200c62154d03734e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331750, "uuid": "19c88d13-f54f-4396-9f92-8ca082c38edf", "comment": "Malware payload (Gafgyt)", "value": "60d150d7ce20e5c5a62b0ea242f73c748daeef46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331750, "uuid": "b9e23e74-ca94-4a0d-9f5b-bde1a50e0a4c", "comment": "Malware payload (Gafgyt)", "value": "b313d941540b30019451a106b6421ea881b3300cc6d79c9bf0fa8a20d3f8b0cbd5d1e57c043c5274faeaf1d89ad8562b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331750, "uuid": "9c6233a0-d480-40d5-ae9d-fea043935a32", "value": "T151E4E80B6E328F7DF67587314BF70A249BAD23C627E1C581D1ADD5141F2028E592FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331750, "uuid": "588b4833-ade1-4f34-aea3-e04566db7f7e", "value": "6144:z2S/dEms5U2a9B4msqKpv+/ogsad0CHWXCFU/R2DonnG4YgojWDFae7fuBrUR47M:zH/Z1PGa/E8fTi/SziqnO0cV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786331750, "uuid": "0997f849-5c78-46c6-820f-d86718c9c87f", "value": 672128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786331750, "uuid": "2ce8e058-8010-4d00-987b-229a513009b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331750, "uuid": "b5217e62-bf91-49a6-857b-065e20d42b86", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260ab583-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786370989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370989, "uuid": "0cb7ba9b-492a-4370-9201-055f194dcb11", "comment": "Malware payload (PhantomStealer)", "value": "29c45450d73461612b690eaa9102765c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370989, "uuid": "351d6671-9e05-4f41-aa79-7a021e68eaa8", "comment": "Malware payload (PhantomStealer)", "value": "0d1990eb86358e8c0e10407d22b29fe99eaabe99f8a2fbd0885eba5449bed6ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370989, "uuid": "3afa5d19-5d9f-4411-b486-f8a601ed1c37", "comment": "Malware payload (PhantomStealer)", "value": "cb4d09a29bf6739a2c39afb66cff0344e8db3681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370989, "uuid": "7fa186c3-6447-4eb2-a650-2bd66c05e5bd", "comment": "Malware payload (PhantomStealer)", "value": "ee34d669c374b9dc7908ae640d37f3ef749e4f5ebe3ee1b5a5e898d7869d0751c1f4f8afadd46b7d200f1bbfa4acaa83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370989, "uuid": "aaf05c59-352e-4388-a69a-ca98aca97399", "value": "T15E75229C236BC807C6D36EB00D20E37955B95D84A801E633CFF6BD6BB97A2966C052D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370989, "uuid": "23916eb0-6ecd-46d7-b153-0c2d4960b622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370989, "uuid": "60090a1d-81e9-4497-b9a5-ee769e368caa", "value": "49152:MtimRD2GJQ1ZqLDgAff6hXIvbcBB1eGxW+b:MtimRfiqLDgi6h4vw1e8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370989, "uuid": "50bd4cf5-fbbe-4399-8846-6795c9564082", "value": 1637888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370989, "uuid": "77453a00-d044-4995-aefe-a370d70e57ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370989, "uuid": "6c7b49da-7e60-452a-bf1e-434960fa6987", "value": "0d1990eb86358e8c0e10407d22b29fe99eaabe99f8a2fbd0885eba5449bed6ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24345c87-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372704, "uuid": "20162e17-5316-42af-a12d-434a0961f9d4", "comment": "Malware payload", "value": "0c5a4ef35ee89173c6a0b5cc09d36cb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372704, "uuid": "97f96bbd-c483-472b-8595-2cb8834dd266", "comment": "Malware payload", "value": "0d65e4a99cabc0eec5fa2ddadc32ab2cfe0caf5fe5510e059196128753929855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372704, "uuid": "1591f114-2647-4205-b3ca-4a887e112d5e", "comment": "Malware payload", "value": "2bc3fa1f90c3a8536157b38629fc353ea43019e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372704, "uuid": "4f6c5064-bbf1-4874-9d7c-aa3b01442897", "comment": "Malware payload", "value": "ec1cea8232d5001d109418f6c8a3339c82fea9125b40654c4ac8c7cf3985dca4fa2b10a1393fb9eb27b767aaa39fae77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372704, "uuid": "f2e1d8f0-6a6a-49a2-8790-42f9b933fa3d", "value": "T126F612236349563DD02986755672E21F383F6D306ED28D0ED6FC3478FBB62B0293A646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372704, "uuid": "1b633ea1-ea23-42c1-bae0-9378ef60ee00", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372704, "uuid": "02f3fef5-3cb4-42bb-8788-e0e3904645b9", "value": "196608:FuNY1k10RqkdY/dbum2gBeJUsQQ6Eitv2VBeMe7Bw/a:F/1k1Iqkd2y1mIeMeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372704, "uuid": "cc479dd2-495c-482f-a872-9fcace144b25", "value": 16133173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372704, "uuid": "f2bd199e-a04c-4023-a73f-eaea9be52bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372704, "uuid": "d8c154c2-c88c-4aa5-ae8f-7ebcbfe5a940", "value": "0d65e4a99cabc0eec5fa2ddadc32ab2cfe0caf5fe5510e059196128753929855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725b92f3-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368540, "uuid": "6126ddf6-fe24-4613-9975-88b0b534716a", "comment": "Malware payload", "value": "df87e4a4892830d2e592654b28914cbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368540, "uuid": "033365e4-58cb-417e-b67e-39ce8f3279c0", "comment": "Malware payload", "value": "0d6d527e4ae081dae608f12be1d2a911c6d2305db00e3d2f7ddcc3651ab8cd56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368540, "uuid": "164c799b-3a0c-4422-9aca-d8e32dc065f7", "comment": "Malware payload", "value": "c14ac4405d913b144ef57b51a2a1dbfc58bf6e73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368540, "uuid": "48bf4eb6-58a9-45a4-95ec-47e51b8cf104", "comment": "Malware payload", "value": "5e4072babb255f5d47569edfcf44de9f1bf29ae4baf583b7433eceabeb479241f3f6cad60fa2e75085392190027003ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368540, "uuid": "0b42e6ed-ec44-4fad-b3d1-565535eda3ed", "value": "T1E3622AD2F0A366EDD078C239CA9F13B7D579305827391B7F5BDCC2582D813202A98799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368540, "uuid": "a0f9f27f-e8a4-4d32-b8b5-e32d3d814ed2", "value": "52d71acbb2709ed0e128fc85766390ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368540, "uuid": "0ecd3c20-954b-474e-a6d7-b1dd0dec0027", "value": "384:9QgfWzwIV9ZTN40YKCIcEAtKcupfY8lwy:zfWfTPTAt4f/wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368540, "uuid": "24c19f0f-4a55-45f1-917b-d3635cec5ba5", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368540, "uuid": "704549f5-9b09-4bfa-9a39-62cfe90df1c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368540, "uuid": "9e116e8a-9b31-42ba-8f0c-7279163c2ff9", "value": "0d6d527e4ae081dae608f12be1d2a911c6d2305db00e3d2f7ddcc3651ab8cd56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9343e7-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371164, "uuid": "c7cbb8de-a18c-43c3-bf30-512aed5e4b2c", "comment": "Malware payload (Vidar)", "value": "21f555dda8b7b316cee879a5f2556203", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371164, "uuid": "e8ab5cf5-fd79-4d60-b05c-6e1be83a5d92", "comment": "Malware payload (Vidar)", "value": "0d94ac87482cf0b01ab4bd86931d53849b04b39dfbfa482f872bc2327bae7a1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371164, "uuid": "86f3cf7a-80e3-4bd6-86b8-584e7ee90a0b", "comment": "Malware payload (Vidar)", "value": "e6c1dccc38a472d36e90b18535aac8a4db50cfc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371164, "uuid": "50295fd5-9812-4cec-a02c-12dfc570a491", "comment": "Malware payload (Vidar)", "value": "c88d9e5e12fdfa9fc5a45b4b533c1fa339735badf0a55fe96afa8ebf30e454c99b1f2171028769502cc20487c388491c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371164, "uuid": "e02ae2c1-2465-4fa7-811c-514fcad1e27c", "value": "T1375209C731E3A1AED1A8C378CA6E15FB4A5A30C90B195FFF41DC859835C25117A7CBA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371164, "uuid": "bd55619f-84a4-4b4f-a399-af79fb828b4a", "value": "cf623daeb316fdd052c715e1828e1b00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371164, "uuid": "d142439a-da2f-4f89-a2ef-aebb1820f152", "value": "192:OH0RXdoF8xrOP8NH2zbvwd5ZqJTqxv800WctdIMSkE0boWu3VgIuF:O0XCF6Ozbv0qJHZtdVfoXlgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371164, "uuid": "55edd2c9-8867-436a-9100-bd68b3f6fc76", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371164, "uuid": "f97036cb-da3c-4883-9b60-4679b7f8a853", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371164, "uuid": "585b5668-6cf1-47d1-b114-15f51a7d720e", "value": "0d94ac87482cf0b01ab4bd86931d53849b04b39dfbfa482f872bc2327bae7a1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc33744-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786374139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374139, "uuid": "683e7074-7f08-4914-9f2b-c0488a096032", "comment": "Malware payload (MassLogger)", "value": "5c86a12bd42c78cf32a43c4731c2b431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374139, "uuid": "09f44184-9315-4412-8697-5107744541d3", "comment": "Malware payload (MassLogger)", "value": "0da4925cc323464f2f002ce18116856a24e065fd0bd32acf9eb5494876cf2331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374139, "uuid": "4d41ff96-8dec-44fa-9d54-dace5663b90a", "comment": "Malware payload (MassLogger)", "value": "a056a26c3e28abc249956bf3113e3e453ee92029", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374139, "uuid": "c287c4f2-4c23-4044-88b4-eb19288e4163", "comment": "Malware payload (MassLogger)", "value": "52f55d6cc8969e3c9501cbc834a651f7a2f278ac61875a54e4a64a48fb561ee6e42f9c7bca1ddb281c5dec52f5f50093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374139, "uuid": "6bcbb184-8df5-4fc9-a001-647016d0d394", "value": "T19E45CFAC3601B59FC853C9368A64ED74AA146CBA830BD20395D75DEFBA0D997CF041F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374139, "uuid": "da4b518e-d658-4426-a430-7b5d6b42629a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374139, "uuid": "f4cbfcee-fd76-4a9f-9a91-e46dc111968a", "value": "24576:Q3KOfkPHCGbtvEs55vtiM60+BaB9n9SDSSuds+eA9s:3OcPHLtvEsiM600UfSVud2Us", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374139, "uuid": "85eb774b-94d8-4ae9-8ac6-4d131912c9ab", "value": 1216000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374139, "uuid": "4cf68c95-fd13-4372-9ebc-45870ea034b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374139, "uuid": "7d195e38-5813-460c-a2a3-7e43842a4810", "value": "0da4925cc323464f2f002ce18116856a24e065fd0bd32acf9eb5494876cf2331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804f7c06-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786339787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339787, "uuid": "c7293954-03cb-4e22-a93b-325042ab9839", "comment": "Malware payload", "value": "110f76d622ded8035b6c854065e916e4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339787, "uuid": "17725613-2931-4a58-b3a6-ac77ba3b838c", "comment": "Malware payload", "value": "0dcf74772dd074dfe0debf03ece61b81e29d5a6e2778d6f9cd80a12e4d4f0a91", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339787, "uuid": "b76a7971-e7fb-46f5-9908-c696d520ccaa", "comment": "Malware payload", "value": "56426222662077bb9353d87ac1e0553e8950a3f6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339787, "uuid": "11d370f3-22ea-44a8-80eb-6073b2e57230", "comment": "Malware payload", "value": "ef81c1c42b3171a74fb371b8443613c94259cb99e1f388b85c2ac3d22e68480a0fc0d63e3f90a40de697175bdc400633", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339787, "uuid": "28cec288-bbe2-4ddb-a0cd-88670f06a03f", "value": "T129E061D3F860E621F5CDD03D5259659481C3086B2374BEF1F0435E704D1C1453C6E7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339787, "uuid": "d63f79b8-5ad8-4253-9ab9-fb7282d2a748", "value": "6:higjkTFfFFuJ6XVf6gdlCtuiMIlRr6+wFkREuNFPE0X9C2FZN9olBCqAVFgpQ:ASkBFFrd6gdlCIiFu+wFk+W8SlF/HjgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339787, "uuid": "1170c27f-7180-41ea-af3a-3be8f7611d61", "value": 395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339787, "uuid": "97daef5d-ae12-4101-b6fb-0bd2312999f4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339787, "uuid": "8659e428-ced6-4241-89d2-2c340833c36f", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98017fca-9465-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786329948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329948, "uuid": "721f5d65-201c-4f78-ad52-f7e5652ac1f7", "comment": "Malware payload", "value": "46feaf643bca0df35a8dbadedce14b15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329948, "uuid": "f0e94d76-2d19-44f7-8a0a-0799e6577d9b", "comment": "Malware payload", "value": "0e7046b9d52206b0334e124ffc17d78c29cd4f6bfee460bfd218be3f3b7a0e53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329948, "uuid": "70fedaee-3dce-45d8-8444-ceb51fb242ad", "comment": "Malware payload", "value": "94565984622eead26cfe42917b626c503b26f386", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329948, "uuid": "c496c023-71dd-4621-b100-341c4531768c", "comment": "Malware payload", "value": "9ba036885742603cd6a57911e3ebbc9e67bc1f849a5d052808445a424892bdb27084734b6a863f94b5f7dce2af06fe11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329948, "uuid": "f15016e8-04b6-418c-8943-87f676db0540", "value": "T19BC3B3576912587EF4B203B105DECAF83E23A1F792B70D16682B1EAD5F13E959F060C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329948, "uuid": "7143b489-9473-4d7a-a4e5-344f53ed0f54", "value": "1536:pvwk+YQMpzAxjG8hxW8XqnEYb0tUJclXiUn5p5M/LWt81kZxug+XskqQVn0Er:pvwk+nMyvWrn/bknlXihqtjZ2sFCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786329948, "uuid": "62674cf0-1467-4240-a6eb-fcba8177d8bf", "value": 126952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786329948, "uuid": "32fe582e-82d8-49a4-aa53-11d2a1078d0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329948, "uuid": "68b2f2a8-bff0-4162-b75a-bcead4637ba7", "value": "main.xtensa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8889f479-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786372013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372013, "uuid": "1846ca3e-ae30-4acf-93f8-c9e16cbb3385", "comment": "Malware payload (AsyncRAT)", "value": "f03ddef69caf6b0bdd009f2ec1f41c0b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372013, "uuid": "f49c5430-4124-4775-bdb6-2afb70e5f4c7", "comment": "Malware payload (AsyncRAT)", "value": "0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372013, "uuid": "cefb426b-80d0-4dde-aaa3-c6c5ea7033a6", "comment": "Malware payload (AsyncRAT)", "value": "9fde07b3c8e28944dacdb8bdfada5a3d8bdf5eac", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372013, "uuid": "e2d26c5c-6611-4e2d-9d3b-71c0ee84aa2a", "comment": "Malware payload (AsyncRAT)", "value": "6f645938ce3d0d1e5fd360723ec5a5a7171d1ee1f12f6325e92fc14fc852cce76419aab966f743010c989d0eb3d2ea9a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372013, "uuid": "1f902a41-5832-4ba1-bfbf-9056d3545ebe", "value": "T129F4121C6A1BE917C54013360BA1F275127E5EDAA812D227BFDD2EDFBE32B168D401D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372013, "uuid": "0edd555a-bed6-4b60-86bf-4c182e948476", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372013, "uuid": "d9ff293a-642d-4761-9180-a07cfcb20488", "value": "12288:yS1FlJdbPoA0/ncMpxV3AmQ4ZiCLQY8QUqf4NkAHAPO4xwoHZzAeETkmmOHBsNBV:VFd0/n3pxOmQ4Zi1nqf4SAHAPOYmTXHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372013, "uuid": "4966430b-2ff7-4b3f-b171-b56e394557d7", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372013, "uuid": "9ab40e9a-aeb2-4da3-a083-726ffa675aea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372013, "uuid": "c3b5e8a3-c0c3-4e55-bcf4-617f0c476f4a", "value": "0e7d3f1e56345f9369a8b3b15fd71585ced37bcce8c25e09796620459acbc139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3411cd20-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (a310Logger)", "timestamp": 1786369294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369294, "uuid": "21de75e4-541b-4545-b88a-051668b17ab6", "comment": "Malware payload (a310Logger)", "value": "d1a24dff034ba1685c27df6301f07bda", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369294, "uuid": "e651e182-8b82-4704-b80e-69738e871cc4", "comment": "Malware payload (a310Logger)", "value": "0eb859ee673e74185809a19b7b43da124e500f128fd3cfb94272db5ffb88511a", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369294, "uuid": "b1b936b7-84e3-4b4e-85a6-3b2757c1232c", "comment": "Malware payload (a310Logger)", "value": "2f06ee1cf57c55d9d8e5ecd1f944c0170704e05f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369294, "uuid": "8551b452-072c-479a-a90a-33724fbe19e9", "comment": "Malware payload (a310Logger)", "value": "f4797347e871c030f6b37cd3591bd5b1c7880269e06ba6b09e36cb0e2eda330da5b9308571027d3e8d2f32161350bbb6", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369294, "uuid": "13af61c3-af11-4846-ac85-5ac43c68e8fa", "value": "T13C944A13EB60A11EF1A389B1B8B5925A68277D351B98EC4BF3409F1A35715D3ACB031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369294, "uuid": "2e443d29-f63c-4304-bb74-13a3c1eea8b6", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369294, "uuid": "a624214c-e2e5-4fe3-98aa-d33c7d5d300d", "value": "6144:L8d1/w5KA81IJ8GpF6nuTmOOUiBUrjndYleLoEXx+tYn1GnKEy4tMvbyy:QjYKkJj6GmZUiqr6KXFTEy4tup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369294, "uuid": "e2e6078d-d3e0-4e89-98c0-9817c9f67a37", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369294, "uuid": "5abc15b4-6d00-4836-8963-311b8bcbd6c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369294, "uuid": "afdd2e96-572b-4c79-8bf3-05fce4a55827", "value": "0eb859ee673e74185809a19b7b43da124e500f128fd3cfb94272db5ffb88511a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67bce2a-94ec-11f1-bd95-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1786388089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388089, "uuid": "deb7dd85-8c4c-4304-b298-5e9cff73506b", "comment": "Malware payload (ArkeiStealer)", "value": "e230b0053ada6cc7cd7f7ede601ed977", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388089, "uuid": "dcac2046-2e8f-4d89-8c2e-e91393857664", "comment": "Malware payload (ArkeiStealer)", "value": "0ed0b8553a53a330300c5dfba08f7e9e882da16b301b06d8cb227efbcdb9132f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388089, "uuid": "b9c296b2-7298-4521-b22c-9e5b520ea0b3", "comment": "Malware payload (ArkeiStealer)", "value": "14b01199609a14fe57553c762d35896407c80d0f", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388089, "uuid": "a1f8e4cc-316b-4c62-9396-6f9e06f59c0c", "comment": "Malware payload (ArkeiStealer)", "value": "4621f7716bf73b7f54e739190f3ac5e472b96aceb1920daa0b7bbac7f2368b648796cdfece1e202d10b7e87ea96dfd6e", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388089, "uuid": "f34956d2-af47-4070-8d0f-b044db42253e", "value": "T181368B03EA9658FAC09AAB3888774291B674BC4D4B3037D72E757A742F723D11E39B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388089, "uuid": "9e406e07-6d6a-4ef0-8852-fbf5f5690f7c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388089, "uuid": "affcc5db-5ec6-4dae-b736-54900e035316", "value": "98304:cI1EbvpsjpQZnNjCmZkZknTP9ivYRrNn8yf9:cpW9QZnNjCKkZ6D9ivYRiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786388089, "uuid": "4ef42117-78b3-4f3c-93c4-627ac46eae84", "value": 5196656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786388089, "uuid": "0f0e71bb-799d-4a7a-80d6-efc78fdc54ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388089, "uuid": "5527c94b-fa2b-43f9-8ba2-e72c32c2c6ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8afe19b-94e6-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786385462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385462, "uuid": "609da5ab-f2c1-41e1-959a-59a85eb937f2", "comment": "Malware payload (ConnectWise)", "value": "83a84101ddf5da078a74ddb6df11e08d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385462, "uuid": "fdfbadeb-be13-4b6b-a9be-8a00b0294fd5", "comment": "Malware payload (ConnectWise)", "value": "0eebdbd4fb46d04352fa09ce96cb34991bd5950cf8a8be9e403ddb1d485a870a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385462, "uuid": "86cc525e-ffd8-47b2-a6c1-1a39b4b34373", "comment": "Malware payload (ConnectWise)", "value": "cfaacb94af3a48446a5543efd12f204362f63913", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385462, "uuid": "b957c560-d640-42b7-a8a1-9fc4c499c18d", "comment": "Malware payload (ConnectWise)", "value": "caf8843baf4fcb706a8c07d1370c45d42396b2d8f0c48ce5289f164ceb851de0b2c6e5dd06d4c13c2bcda7bf21ff1865", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385462, "uuid": "fc475d1d-6700-472b-9554-fe4bcae6f51a", "value": "T195646D11B9C48432C673383147B4E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385462, "uuid": "e48771bd-212f-42cb-bcfa-42ef2821dcee", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385462, "uuid": "e4a1fc87-70a4-4f75-a55e-08891f38fef8", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji97:h1iw7gryNkSV1hy1Z1u2JLu97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786385462, "uuid": "7d4b78b7-28a5-49b8-9af5-4e64bf108e57", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786385462, "uuid": "26072377-0e81-4151-a91c-b6333be58498", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385462, "uuid": "df1990c6-219d-4ec2-b610-ccecf85b90f0", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aec11f7-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370514, "uuid": "74253304-57a1-452a-a2e1-0dcac15d4d92", "comment": "Malware payload (Formbook)", "value": "6f33923344b87bcf282f7f1839511431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370514, "uuid": "9a001e26-a348-4e9a-ac8d-5e0687f5b7f2", "comment": "Malware payload (Formbook)", "value": "0fe236a4aebe9d3753ec755a064ff42943528c99f7cb0561265dadd14ad425a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370514, "uuid": "ab92b55b-ecfb-4a27-be51-1c0a603c0f48", "comment": "Malware payload (Formbook)", "value": "2cb39ce61a166455a03ab23d84eefc3fd679e8e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370514, "uuid": "b2d68bdb-5576-43b7-9802-3064a15535cb", "comment": "Malware payload (Formbook)", "value": "f5192549c3f4ba0719e42dfe4cfa580d9f0684d18efb3b572b61fd4d68c3c4cc8e1b2840d1a46ca2f7a530f1cfbb1ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370514, "uuid": "8d7c5442-89d0-49b3-9467-8f043be10640", "value": "T12D3512546F1DCC11C4E217755AA4F27412B86E8EAD21C6179AFCADBF3DBBB022D00762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370514, "uuid": "2b320205-b604-46fa-ba41-ad447933625b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370514, "uuid": "aeecb3c9-6d09-4db1-b4e6-9133d59706f7", "value": "24576:5rj/ngNFb54OY9pXqgt9Bm7X1ruRiF1GOxbOHMC6Z6UFz2Wo1eUa3Lbv:5rj/ngNFb5479pagI7X5uRMLbkMBsAL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370514, "uuid": "98f78dc7-1811-47cb-bb4e-c9c302808cae", "value": 1082368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370514, "uuid": "46961afd-8f4b-4574-99db-922eb9b20d08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370514, "uuid": "f60c5097-55ab-4cd6-9578-3788cb07fa48", "value": "0fe236a4aebe9d3753ec755a064ff42943528c99f7cb0561265dadd14ad425a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd022b3-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369042, "uuid": "fe1844b2-d8d4-4b40-ad4c-fd65ceb99d38", "comment": "Malware payload", "value": "0db86c009fd1239c7c2edc9e711bbd41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369042, "uuid": "022e5a95-6941-409f-a73a-58ac365518f0", "comment": "Malware payload", "value": "10bb24172e32f87ac9ef1a7eee4a2f42a587315a72d5b25816cef834a89e8321", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369042, "uuid": "4881b647-0246-4422-b337-407d3c8c9548", "comment": "Malware payload", "value": "d1dae19a17c86cb1f1113008bc8ec67f164740c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369042, "uuid": "4cfbef3f-3f9f-4e22-8fc9-634b7ed347c2", "comment": "Malware payload", "value": "8e4e9623e4072ddf48dda0a61444fd0a938bb4bac35805c1e6e1c74c15c8d3d9cd5e93c1b859a2e9e89ea4e02fc79184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369042, "uuid": "5728ca4f-ae51-4a07-b206-f97a37b28928", "value": "T1E1D4E041EFF6EDB4CE34857F86A572725E3E7EC804B5795E2208B5697DB8D00C824386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369042, "uuid": "6730eb78-e7ff-4a08-93b5-508b2c743eb7", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369042, "uuid": "3e466e3e-90fe-4f2d-a848-a409bae02916", "value": "12288:WBQGXvu2mtzC+k6/lC0Gdhg81zRk7aeCnRuAkfrA:WBtX9H5OfGde81zGCn0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369042, "uuid": "c89a030b-ab9b-4302-825f-f08ef5b65d52", "value": 637536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369042, "uuid": "64f13ea7-788e-4cf6-bab1-7e1b361746f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369042, "uuid": "d8c52058-6286-4241-bd5d-ac4336c0d477", "value": "10bb24172e32f87ac9ef1a7eee4a2f42a587315a72d5b25816cef834a89e8321", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc0702d-945d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786326579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326579, "uuid": "18019bea-901e-443e-a7c9-bec55b7d96ed", "comment": "Malware payload", "value": "7619b80e26d31581355aefc1ff867bbf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326579, "uuid": "141dd93c-3d5e-4e62-b037-79dfb27c6719", "comment": "Malware payload", "value": "10fd2c56ff14202d44aeb6ecab9ff5cf36c148bba9abaaa641496de2319979dd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326579, "uuid": "4aebc2b7-7332-4efe-9174-87ae42326aff", "comment": "Malware payload", "value": "6450a575c9c838659cd2af50aa928f7e5f1ba22d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326579, "uuid": "1491d695-3d25-4f8c-a86e-f257547c98e9", "comment": "Malware payload", "value": "ec2cc7ffa32685d13b7007024e631eb40a6ea6aba4db2a9be8f4093a6f6ae446c8bebf96bb595c688f4f83228e22c2c0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326579, "uuid": "09ef0d44-0235-4e84-a159-2e1af617f081", "value": "T1C7316EDE06202A311512CE5EB3A3319CB6CDA1E72D9FD7D4ED481EA942897CCF261B0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326579, "uuid": "0e26d691-87e2-4f5b-b59c-522477172074", "value": "24:zi0tWL9LHH7dDhGfRbbsi56ZJLac8c6uzXto3T9zXZ7Z8X/:zi0tWL9LnpE+ApduzXtq9zk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786326579, "uuid": "e777b7a2-c8c8-42dd-ae58-bc334acbbe20", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786326579, "uuid": "fcb1029c-14ee-4f52-b94e-62623fae7933", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326579, "uuid": "662cdbca-7ca1-4d39-864c-04a6e559c7d0", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d0d3b5-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369170, "uuid": "d18e562a-5f44-48f2-bbc0-bd532e29befc", "comment": "Malware payload (Formbook)", "value": "cedb2b4e75f49c633c07c13b81684412", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369170, "uuid": "65db789a-7d32-4d21-9731-c3be3e86c6b2", "comment": "Malware payload (Formbook)", "value": "1161554301dad29fa9b3558bf006f3fa49fac76b8aedd65a5b9ba14a9fbeee33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369170, "uuid": "1698cf92-2956-495d-8a26-51c7fa37c65e", "comment": "Malware payload (Formbook)", "value": "3baa9a8897a42af43cfec75ed1c239dc8004dc0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369170, "uuid": "8deb3f1f-b4d0-424d-ba07-9e4447e53dd1", "comment": "Malware payload (Formbook)", "value": "751430b2e488a0b47fcc14678c4e4f2b624ae588d8a5dac2c519b63ae793cb010b0a920fdf8b245392e7de0a1c4c8999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369170, "uuid": "41c79fc9-f724-4b0d-bf24-3f99d582a5ce", "value": "T109351254276ECD01D1C60BB11EB0E3B416A98D98E531D303DFFAACEBB66F746A845390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369170, "uuid": "d10c2bcd-90e8-4a11-8595-dc30395143dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369170, "uuid": "127c4a21-7b3f-4770-824d-2663e6ca609b", "value": "24576:qZkYeJaftoxTYhhj3VQImGv60JnbU0JJbadxW1GtCbi8crYDD:qZgsZFQF0lFvBw08Uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369170, "uuid": "c168e86a-b68e-4378-a8ff-63a0f71b4a01", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369170, "uuid": "f6a265eb-f595-4c98-9d59-c2de24cbe750", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369170, "uuid": "3be5d502-e3f8-4832-9dba-97728f61b32a", "value": "1161554301dad29fa9b3558bf006f3fa49fac76b8aedd65a5b9ba14a9fbeee33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97b21a8-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786368659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368659, "uuid": "59135270-c983-4090-8313-efcaa24d6fa2", "comment": "Malware payload (AsyncRAT)", "value": "064906f3233742f88dd2f8a227361895", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368659, "uuid": "2adce66a-4cf0-498b-a2a5-5e21561710b4", "comment": "Malware payload (AsyncRAT)", "value": "1176ef1fbe604d88e8da129d5fb41cc67788d32a9e0381d6f5f505f4c4603c2a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368659, "uuid": "c7fd66ba-4f31-459d-ab74-6f2709a25894", "comment": "Malware payload (AsyncRAT)", "value": "a85c814c02125b7d7d045683b28a40b4c4f2b735", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368659, "uuid": "a41e0ddb-c4df-49cd-b982-e17f67ae5437", "comment": "Malware payload (AsyncRAT)", "value": "778766aef2c0d1d2069c36e8d9c137b8960d80537223027e7da6d02f33c6e46865d72a7165b6ae6298b770c7c3999825", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368659, "uuid": "2abf8392-77b8-4468-a04f-650b17ef50ef", "value": "T1B005E0C03B29B709DE786A309536ED7943A92D69B010F9E67ED93F8778A93015D0CF42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368659, "uuid": "ac91af52-c6f4-470e-9c3e-43d628c1d725", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368659, "uuid": "73149123-b3ab-4e6e-b6da-b7d48c6c8de9", "value": "12288:6lOzqZ47iqRcMUnVQIWNqUhmjtwHK0a3zB2eLmKggyWf12JzEq3KJCvOlE:aqGnnUpmjpt2e/glWSzECy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368659, "uuid": "27ef2ce2-e965-42fc-aeac-248cc8f58bb6", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368659, "uuid": "24d743ff-1043-41fe-8265-d765b8bc8cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368659, "uuid": "f9675be4-40f9-4a89-aa9d-7ee20ff84a1e", "value": "1176ef1fbe604d88e8da129d5fb41cc67788d32a9e0381d6f5f505f4c4603c2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b47d6e4-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373655, "uuid": "f823ad8e-a19c-47c0-8c1e-80df727fbb2d", "comment": "Malware payload (Formbook)", "value": "2661489de6e331cbd9875ffae43035e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373655, "uuid": "72ef2451-4a2d-40d4-8f54-54755055f2fb", "comment": "Malware payload (Formbook)", "value": "11f3ef4344774c9a0490b077ed446f7be49ade73a0072682c921e5166ee24c2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373655, "uuid": "349ca0ff-a0b8-430a-83b7-7c4adab7e3a9", "comment": "Malware payload (Formbook)", "value": "829377dec7c1497225d72aeabd6294f5b70c8e0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373655, "uuid": "8ef92691-2e71-4cdd-b5e7-77f99f653e6f", "comment": "Malware payload (Formbook)", "value": "98c8dbb541b26713dcd93c38814c5cf799c2d76401181f2350e30bd8082d34dc54cd0c62bf0bcdde00ea6fde97a45897", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373655, "uuid": "a453976b-55d9-4edb-90e9-9935f5b7959f", "value": "T1C82522889351801BE6CB977C69DEE031A7F4ECCEE622D2874FEE0CB77D522642416346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373655, "uuid": "d3aad24b-dfad-4467-872e-f5c825c91bb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373655, "uuid": "d751941d-18ef-44c4-9eb7-c91de8ba8e5c", "value": "12288:VqeDCJsPraBl27sEikec2OicHG9F79MuWCiBnh3yPsLzIyuLgUf13S78pykw7cLq:JeJyGC7m5OPHwMuYdyoBuLb87oytO+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373655, "uuid": "6bbfb18a-5be7-44f7-847e-ed2566d2be03", "value": 1001984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373655, "uuid": "b1e73e53-f0f0-4a59-9ce7-35b409997955", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373655, "uuid": "9ee5ef8a-9830-47bd-a076-bcdf1d6b8ffc", "value": "11f3ef4344774c9a0490b077ed446f7be49ade73a0072682c921e5166ee24c2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9481e0f6-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372033, "uuid": "fd184903-a2d0-4102-b0b9-ca7f90c4e3f8", "comment": "Malware payload (AgentTesla)", "value": "1e69c9a58d6be0b71a5e12425f79e66e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372033, "uuid": "89b0e343-a7c5-4f88-9958-ded8f1627cd5", "comment": "Malware payload (AgentTesla)", "value": "1203b91790fca9a278e54674db530c661f7f6a1e885e2844e9811e1b5c07d66d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372033, "uuid": "3448f12e-cb8f-45a6-9407-4caa804245a7", "comment": "Malware payload (AgentTesla)", "value": "bda73d3d6cd2b5c9386e8048a08d2ff3db865a02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372033, "uuid": "e735da0b-b98c-487d-8c85-cbbb13d04007", "comment": "Malware payload (AgentTesla)", "value": "54e427328bff932a5e2378563e407983f11533c6c68df4f1f30765065395806d41b98f678c4e4ed034184cb8326a8dda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372033, "uuid": "5331d8b0-2e6e-442b-ba19-91173515e58f", "value": "T17C152251FBCAEA22C3825BF40EB6D17A13348D9ED831E3578ED7DCE77089A112494762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372033, "uuid": "6d14e366-6eda-4720-bc84-f1f1546fe466", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372033, "uuid": "7e1f166f-1dcc-4c7f-a53d-5cdf42f74db4", "value": "24576:hrj/Og3JCfQur+ThyrVyjQicLyhNKvydzVEgOHs9:h/PZCfaMTi+yDKKdzVEgMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372033, "uuid": "c97f8ff7-0568-4cff-983a-90ba085c7bb5", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372033, "uuid": "2c45378c-e9cb-4ca5-857c-f26a6b201c18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372033, "uuid": "74f3221b-7a5a-4e83-affd-078c90fc768e", "value": "1203b91790fca9a278e54674db530c661f7f6a1e885e2844e9811e1b5c07d66d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389542ab-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368443, "uuid": "ac3d5720-d284-4ca6-a73f-b726ada30938", "comment": "Malware payload (Vidar)", "value": "342914d874f2d8e8e166ccaee47d35a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368443, "uuid": "fe36f660-1fe4-4711-8065-7fe6060481f4", "comment": "Malware payload (Vidar)", "value": "127370762760e8dfb8053fc21233a4d17c028db8424293746ed732496cbf067f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368443, "uuid": "5c5d2912-108a-4e5a-8ba8-225752ccc43c", "comment": "Malware payload (Vidar)", "value": "e97f3745de2419f3c78d9b32d0e78e50e3e0cc26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368443, "uuid": "6a2b3b6a-2462-4b4f-bef7-7c514c7a0d20", "comment": "Malware payload (Vidar)", "value": "af4a3e37bba925bb17672b0d105fc5019d78b7796279ce551deb0f2a07d56d256ad6419c66bf49599eb843ed24f0bf7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368443, "uuid": "1866709a-58b5-43a4-9aee-5fe0888df5f2", "value": "T114422BC3B1D6E0ECC2AA837C9DAB21778A663045036289BF679995441EC3211E1FCBA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368443, "uuid": "185be29a-f4e7-47ef-ad90-69c47ed2d995", "value": "6dc49e85762e4ee01dd5464c00241541", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368443, "uuid": "d7cc6133-49ca-42b6-bbcb-6c9841cbb5d5", "value": "384:Ouxb1xOP3mTjEKxmK/hvA9AG2vvEAY8UyB+KoblO:jnxxEKxmMvA9DH8UQqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368443, "uuid": "d3a31bf3-10fe-42d0-8b7a-552f00123f54", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368443, "uuid": "c54204a1-f0ad-46d9-8c22-9c3c828cb6a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368443, "uuid": "b9a92065-7b4d-4f30-bba2-05314bb67cd1", "value": "127370762760e8dfb8053fc21233a4d17c028db8424293746ed732496cbf067f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf54a81-9484-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786343029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343029, "uuid": "ba3a5d58-819a-4757-8a0e-b467288610a4", "comment": "Malware payload", "value": "b7e1f36ad48405bf531fddda69d8679c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343029, "uuid": "51284ae0-f949-4fec-acbf-7514ad600f9f", "comment": "Malware payload", "value": "12d972eb994082b515f2befe1fdeb801e8182fa114f4930cec450d8f4633ebf6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343029, "uuid": "9f997983-fdd5-425f-9fe8-4d2e070870e1", "comment": "Malware payload", "value": "0999eeb1580bf13501efb43cd67d07ab0c87f6db", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343029, "uuid": "ca9ddf88-d942-4285-b16a-b369e9d189f7", "comment": "Malware payload", "value": "ce4f130175bdd36de9d1e3caca11c5e71587d1d9601954951ac92fe927de14f3bda41d78eb61d865a357f3c0f6460f95", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343029, "uuid": "b0d66991-6c12-45da-aa6e-4bac93ee232f", "value": "T12B236D651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCB3CF28C5AA9D911871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343029, "uuid": "64b3e223-bfb5-46bb-b918-ec9b07805048", "value": "768:DXRWNGxVi9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:9lxJcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786343029, "uuid": "c7ea56ea-9490-401a-bd46-604e90ae2972", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786343029, "uuid": "7d93b48d-9915-4999-81e9-e58643648c96", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343029, "uuid": "aa09302c-5261-4b3b-82bd-cc03bd809e91", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d760a4-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786373990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373990, "uuid": "31d21fef-22a5-4c04-b4cd-992bc21c8cb1", "comment": "Malware payload (PhantomStealer)", "value": "d94ee22726c9d8d05a8f4c4ce68b1bf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373990, "uuid": "776bbf2f-cc26-4990-97c4-bdaf23b8ca43", "comment": "Malware payload (PhantomStealer)", "value": "12fb6e25d898b7d478f488ee0cc01725dc62925069f8682dae89d21f90f78140", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373990, "uuid": "d20005d5-275e-45c2-96b7-66129959460c", "comment": "Malware payload (PhantomStealer)", "value": "f85c7f2dd89bc4507bd418e44c0880734b0d7667", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373990, "uuid": "67c31311-6b9c-43c5-988a-d06c3d4bc051", "comment": "Malware payload (PhantomStealer)", "value": "b41fb4507fc35c1a2087897afd709c2524d6357ea2e2dd2b09670e2bcaabe4b46a9c7c1fe1b3b88840c0a2005a612613", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373990, "uuid": "8b902692-4742-4324-8085-f311f030de6e", "value": "T1FA4512586B69E413C85167340BB2F3B9622C1EDEE111E3135FECBEEBB96AE064D04147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373990, "uuid": "dcc43b9a-c9c6-4d46-96aa-edcc14c8807a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373990, "uuid": "89205e85-9711-4bd1-8a4f-94fbd7470e2f", "value": "24576:oeA9sVDViMB38AA7Jxj14iK3bxl3Iab14IGWQY0ihxGvrz:RUsVrk14i4XY0B0SxMrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373990, "uuid": "6f70384f-fbf8-42cd-b9a1-8d17f190d72f", "value": 1218048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373990, "uuid": "45a5aed3-401a-434a-bc0b-f97299aef762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373990, "uuid": "787ead6f-bbac-4139-a30e-8139dbe97650", "value": "12fb6e25d898b7d478f488ee0cc01725dc62925069f8682dae89d21f90f78140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd53ad11-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371350, "uuid": "3d690dd8-3641-4db8-a110-4afcfa96e7c7", "comment": "Malware payload (Formbook)", "value": "89bc5aa21e11c7505154c937047e8e7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371350, "uuid": "461126d5-3573-4019-aeec-a38e94e04076", "comment": "Malware payload (Formbook)", "value": "1312514b9c2d54ac17f34803f8400e0e604fe091d44f5eb9985354b099263ceb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371350, "uuid": "4acba271-7b01-4b22-b7d3-a1e2e83c53b9", "comment": "Malware payload (Formbook)", "value": "dfe2162451b218e3fab6549101a7cb22ea25cd42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371350, "uuid": "13a0c7d7-f163-4989-b769-b0c190ad3012", "comment": "Malware payload (Formbook)", "value": "8830024bc5ab241ddfd3958092b0ea1e9b82a66c6d7d757cd7cf15d0e8925ebec5ebd9e21612249a53f22b0655f54601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371350, "uuid": "a2ff2f7a-dfd3-4162-ac1b-bc2adf7f2fc2", "value": "T1334512606245F206C98567780AB1F3B212B89DDEB511F3465FEDEDEF7D3AB124808683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371350, "uuid": "981f2564-63ef-48a0-ac1c-19cf3764200f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371350, "uuid": "065d119e-97cb-4b23-8815-6aa81d3945ad", "value": "24576:5nV/edOnMGY/j/eC0ZF8WJekHTqfokYmAw2agrxwMkTGb:oOMB/gFL/BkYmlgrrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371350, "uuid": "8bfe278b-e532-4f47-9790-011d609f2d9d", "value": 1215488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371350, "uuid": "54fdd55b-b9fe-4fe8-a63c-253d9f6b93a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371350, "uuid": "a9a94051-742d-48a9-8d9b-ce651f97f038", "value": "1312514b9c2d54ac17f34803f8400e0e604fe091d44f5eb9985354b099263ceb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762330c2-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786368546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368546, "uuid": "e5b32e34-71a1-4358-87ac-825aa09d817e", "comment": "Malware payload (RemcosRAT)", "value": "5aed4f994fde051a96d3b90b3732629b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368546, "uuid": "1f1492bd-18fe-435f-8885-06d69d93f001", "comment": "Malware payload (RemcosRAT)", "value": "132334806bc8620a8900f061ba535b049b2c756a3987c0a8a3bd58a82bf45579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368546, "uuid": "20544a8c-13cf-495a-a37a-3f1cb2fe039c", "comment": "Malware payload (RemcosRAT)", "value": "fd38cd057a0948ea51ed666fa669d66fa9e96192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368546, "uuid": "d30e0192-a078-44f9-9ffa-e2cf57d905a2", "comment": "Malware payload (RemcosRAT)", "value": "0852c4af3464229bf1a53c9f8dfbe01ba25ad217f8da272b298a841454fb98a4c678addbb4baa306574e39f75cdedb49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368546, "uuid": "b357a6c9-8238-4118-a7d4-1c58a40c79e1", "value": "T1B375F1D83721778ECD56C8318528EC74A6502D7A6307F293A4DB37ABB94D147DF08BA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368546, "uuid": "5250e23c-2395-48e2-a585-3936bff9089d", "value": "24576:TBukqGQ0zp8q8tUntSjDpx6Xf8yWTwgKAhR1i8BqFizMnjsBx5IYc8VAQQqKCng:ckhL90OtSjtckyWxD8KqAzMn4xdVAjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368546, "uuid": "6757c91f-10a0-4826-bc29-9c74dd9b4baf", "value": 1585152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368546, "uuid": "988602ea-9ae2-4fdf-b0ad-b629707bf96c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368546, "uuid": "8239448b-8ec1-4af1-a5a8-dd94e02eb96f", "value": "132334806bc8620a8900f061ba535b049b2c756a3987c0a8a3bd58a82bf45579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee8287b-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371728, "uuid": "3e995b6c-748f-4226-9ef4-dd91904c03f8", "comment": "Malware payload (Formbook)", "value": "0defaf5b9f0ebc7f3d3ad60069d67b6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371728, "uuid": "3a6bf325-b260-4125-b6ab-f2353d09c0cc", "comment": "Malware payload (Formbook)", "value": "13280c6a70c48732b500b35f52da26c74cfc1a6bedf64d03304a96663b5d7938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371728, "uuid": "7f0e28e4-db05-4db5-83f6-1fabff4b9a89", "comment": "Malware payload (Formbook)", "value": "e4bd8c3f809e76ca11fa17e13cb77f3131cc8305", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371728, "uuid": "405c6351-de96-4c3f-bf03-2b26d21f2b6a", "comment": "Malware payload (Formbook)", "value": "0772efe40e278d0375ab7d5329b7f5e9e3728f5fe477de014145f6b0e8e81d7b938ad735f160d4dae372ed52752ab76c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371728, "uuid": "dc3956b8-ef25-4dec-8f45-2bf78dec8522", "value": "T16D35E09C3640B59FC853C9328A64EC74A6656DAA970BC20395EB2DEFF90D957CF040F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371728, "uuid": "6455e059-5760-47f6-a939-15fe11a3a4b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371728, "uuid": "20bda028-efba-4268-8ba9-9e0a51413191", "value": "24576:5Q46p7JkxOfow8qCEjxD3cF1HbvhMTOqF5+ZE3h9TzyxiN:0XhMqhdLcF17pMTP7Tzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371728, "uuid": "a5cf22d8-d8d8-4008-948f-ef50c23f1517", "value": 1153536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371728, "uuid": "b50b00fe-b865-47de-af31-c3a339919253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371728, "uuid": "d12db644-c78e-4853-9614-d7834d87ba42", "value": "13280c6a70c48732b500b35f52da26c74cfc1a6bedf64d03304a96663b5d7938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4a7ab3-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339916, "uuid": "8852d917-714f-4a7a-a106-59f807ce74e3", "comment": "Malware payload (Mirai)", "value": "92bd261aab30589e89ac0e77beeadddd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339916, "uuid": "f26c4938-fb9e-41a1-bb73-a490b8965540", "comment": "Malware payload (Mirai)", "value": "13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339916, "uuid": "72fee9a6-d636-4238-8d96-ef70190aa110", "comment": "Malware payload (Mirai)", "value": "7105b13258702a2d55c8a7a0f100bbe25891e54f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339916, "uuid": "61efd4fe-b782-44b2-a831-f8c3db7ab6da", "comment": "Malware payload (Mirai)", "value": "fff0b4f9e036b1d718027db7e94b40326db43e6ba5ffc097b47c6f61fc108ea0cc810f9c572f700db103f7c017cfff6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339916, "uuid": "213e64bf-f750-4a22-8303-fd09f1d8e2bc", "value": "T1D7840B98B5E2E2CAD1D4E6B6B31D784D37530735B1DB3146A50EDA3323EF18909BDA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339916, "uuid": "a38021f3-88f6-4911-ae82-fc043728b793", "value": "6144:IhlBa9Ws5eoDzt3kKN49ROFchm3cSiGP9sbTO5EBmc2+Tcm:IhlBa9lvDztE9sFp3oG1svOLc2+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339916, "uuid": "f4c1aa1e-cb58-499c-9b31-c3caed28ef88", "value": 401320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339916, "uuid": "2d026870-a8e6-48eb-b969-483ad76b5fe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339916, "uuid": "eb718b28-a677-409d-b390-048de8eb7548", "value": "vlxx.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56baf32e-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786371929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371929, "uuid": "fbeb2e74-2395-41e5-8945-c528395f1869", "comment": "Malware payload (AsyncRAT)", "value": "d21b04c9be144635b1beec0360ab90fe", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371929, "uuid": "9c5290ce-0966-4368-9e93-48a55ab73d9a", "comment": "Malware payload (AsyncRAT)", "value": "133b106fa34ec8d599211f4ceb049eceb4f750f504f8e8d09df546bb65e390d8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371929, "uuid": "2884b4c2-0820-49b6-8710-043fe85e6d3c", "comment": "Malware payload (AsyncRAT)", "value": "a2e3092c906f1fe94ca4cb607adb43ae7a2fbeb3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371929, "uuid": "cfd05934-2433-4f5b-8952-0290e85e7590", "comment": "Malware payload (AsyncRAT)", "value": "f0dd86200944b53ac27b77644b2419356e6fc8cdab7564ec3294e4b6a92d4a20c5d34849caf1c089d58ceb76fb66d870", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371929, "uuid": "e8a24497-bd5f-4bbc-81f5-2878477427e0", "value": "T176F4125C7A46ED07CD1123B51EA2F375176D2DD9BC00D327AFE9ADFBB962A084C14282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371929, "uuid": "1f76c95f-67d3-4321-a6c9-c30b901a6418", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371929, "uuid": "e4eaf0eb-f890-499e-94bb-09548d19325d", "value": "12288:WlJdbwKcct8dfXaCiCWUeoCWzahUk8Mb+bwS3v8JQm+BbRjPufmB:W5WfXaCiCTtuhUkxS3vaQmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371929, "uuid": "8ec36772-db14-4db9-9af7-664e83bb580b", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371929, "uuid": "a26aef76-53ad-4422-88ab-1a8c8fe7e320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371929, "uuid": "ef8ad8b0-27aa-42c1-9e18-07c615b3468d", "value": "133b106fa34ec8d599211f4ceb049eceb4f750f504f8e8d09df546bb65e390d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36792b89-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356843, "uuid": "212b81c4-6d96-4aec-a35d-1467575e5edc", "comment": "Malware payload (Mirai)", "value": "6f6d00735299d81a446aa4ae6defd489", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356843, "uuid": "4b290744-e985-4eae-97c5-91b19dc05bb8", "comment": "Malware payload (Mirai)", "value": "137bf467e6e97d3780f3f75b3c44c89c222c738cce38f4a0e69f42a440ba6fd9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356843, "uuid": "ae6cc1a5-e2f1-41fb-9ed8-0a71b5638671", "comment": "Malware payload (Mirai)", "value": "76787be67d3f4e784e0e2b5a2a394666816c60cd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356843, "uuid": "19e3fe1c-13e2-4779-ae19-48552f0d9ac3", "comment": "Malware payload (Mirai)", "value": "faba801e3407760b1b6ceaadd2a09e6da7be0386d9bf68d56f05dd9cb7fc7e8553a9a860b4858e2355a47d802b964ef7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356843, "uuid": "e56bf485-4ea1-4427-9b3d-26679cb9d873", "value": "T188F37D80F353E2F6E84705B0617BEB339A359556111BEDC2D374DF35EC62902CA1AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356843, "uuid": "c202ee86-e732-49a6-960a-011c32c6e764", "value": "3072:JLIxaXdi+w3TIeF4hXxBaX593ReY2aSrIvwPzQ+P+:JLIxaXM+2RF4dkRB2+wPz5P+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356843, "uuid": "54bdb9c3-068b-49f8-b5b6-66966f54864e", "value": 159360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356843, "uuid": "09fc87e2-ab2b-479c-99e4-e371a8ab89d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356843, "uuid": "4290d5dc-1fc7-4573-bba8-3655ce49f492", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b52f8a5-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786345792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345792, "uuid": "51aa963a-69b9-469c-aa2d-9742ae1a696d", "comment": "Malware payload (Formbook)", "value": "a782a37bf4ce6685fc48053d0f211de2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345792, "uuid": "81fe9dbf-6a8d-4bf5-b4fc-91cd2e0829a8", "comment": "Malware payload (Formbook)", "value": "13b23ea947c504ef332e0e02c9821f02c21a145ad68e238e4cfc57f4207a3d59", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345792, "uuid": "ded38ced-6731-4930-8024-f47c191a8fed", "comment": "Malware payload (Formbook)", "value": "5dd0d62d6979442093e2c50c814c492bf4d5dae0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345792, "uuid": "9bbb8af6-8c38-4180-aacc-feddc400a830", "comment": "Malware payload (Formbook)", "value": "ec1bbf4511ba3a4b9557e830d7db64cfcef6df826febb04e447974b28ced022aec866b0a74e7a748487f323600e14982", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345792, "uuid": "41c3cd93-77af-4d82-a5c6-f40c838b76f2", "value": "T138E508401318EC70B63D672CD136AAE09A69211311C5EF2F34BC7644B7AEE17A79D9F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345792, "uuid": "1ae3a16e-7d23-4511-8583-33209e671e35", "value": "98304:Uyrp9P3/gkZWFVd8A61zSAbl8I0Ruw7Rp4LShiTKMlTqBInUDmg/dFqMgwc5F:RHv8d8VBoRp4LShiTLTqBInUDhtTc5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345792, "uuid": "05893c09-07bf-41e9-9450-6e1d94a9651c", "value": 3154342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345792, "uuid": "79e57e42-fc13-4f5b-a738-53b3eb0d8320", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345792, "uuid": "c1515121-adf6-4785-885b-4a1fd6bf4f22", "value": "RFQ#N05-337 FASTpdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5e3819-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373630, "uuid": "33ace76d-70a4-447d-a634-9f860512e57b", "comment": "Malware payload", "value": "2aaef534298e6972af1bf1e4e4d81517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373630, "uuid": "84b02700-6e87-4ec9-941e-8aef3be6e081", "comment": "Malware payload", "value": "13de9654042f1e01afde8ec6f3d48596cd75f55cd54b2387c65ad91ee1a48550", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373630, "uuid": "fcf8aa1b-884f-494d-bdbf-39fdd86d38ed", "comment": "Malware payload", "value": "dfa3c2c32f6b3b2fe8e2e512ca135fa3f8610905", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373630, "uuid": "a262d9cb-7494-4c56-89c2-8d75bb97031d", "comment": "Malware payload", "value": "d1fccce41f139c1b4ae8293c6b606de63b197c2246021f5a1a98b72873c0e1bd2812b57917a5101554df6eb1dc198934", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373630, "uuid": "c16f1052-3aa1-43e4-a24d-03fde70f6baa", "value": "T185F30154E1EBC05BE127C1F068EDC731A670BE2607786E7F8461CAF449A5FC51A2C762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373630, "uuid": "fdf21113-4237-4151-92ee-6c76c6068509", "value": "c89b9a3cded6391777b60d810a4b36f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373630, "uuid": "68a025cd-a765-4fc0-b857-4e78f18b0d6f", "value": "3072:llbBMZPUp3tOY8WOvVtuvmMz9o168vqipdY8x2svgBYmXmiVZIAxGPVHd5wmYt/F:nbBMlLvVtkmMqBvpdYsnmWMYVHdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373630, "uuid": "a46d58f8-1b86-431e-aca5-cbae6f181655", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373630, "uuid": "5d619cf5-534d-4bb1-87ee-fccd991a868a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373630, "uuid": "16882cc4-b402-4817-9d23-97e1adcceadd", "value": "13de9654042f1e01afde8ec6f3d48596cd75f55cd54b2387c65ad91ee1a48550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506512de-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1786373637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373637, "uuid": "93279e3b-2289-4c46-bd61-06b54ddeeae6", "comment": "Malware payload (DarkTortilla)", "value": "c5395576ae5a88f33ec5d5b8cf2475d3", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373637, "uuid": "42a1c4e2-0fce-425e-ba65-896c1d0faad0", "comment": "Malware payload (DarkTortilla)", "value": "13f47df57f1faad58a1c4bcc768360a572b9be93412691f55c49bdcaa2d3c1e0", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373637, "uuid": "9e3d7993-60e8-420a-a7c7-051407c2681f", "comment": "Malware payload (DarkTortilla)", "value": "c3b863ce95d8ee5acef3fcd24f96c6008bbfe3c1", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373637, "uuid": "34dd5080-e948-4f95-bec3-4b0f158d149b", "comment": "Malware payload (DarkTortilla)", "value": "7add8f1e7ebbf770a697f74dfc7ebd7ea7153e960992cca69e6ecc351d77b5003daf4db7f7f771b6a195119ab9fdd70c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373637, "uuid": "fdce159f-6d10-4877-b7ec-768f1c307ca3", "value": "T11F85012B1CC756A5C4A84F78A3E804EC23F1532F5257E7B71AE512E9CE4238E69171E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373637, "uuid": "c59b2f0a-2c1e-4e82-8232-653cbb3c7f78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373637, "uuid": "49591c26-b62e-4794-99d6-c7e62b27031f", "value": "24576:z6wxfcyjsvz6Thr2hGUNlerBlRqHN9tayLVXfYbV:WwZcEsvG0hGml4qEwXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373637, "uuid": "fa384d60-70a6-4a83-852b-9e4f1ad565cf", "value": 1796096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373637, "uuid": "3cf38754-69d3-4437-9397-2bae94232747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373637, "uuid": "252fbe99-afb3-4016-a14d-708092730ee1", "value": "13f47df57f1faad58a1c4bcc768360a572b9be93412691f55c49bdcaa2d3c1e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba43d9ca-948c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786346756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346756, "uuid": "046ab46e-806e-43ab-a757-76dda3b4df6b", "comment": "Malware payload", "value": "7549019b787aca9f5a2c5dd1ad0203eb", "object_relation": "md5", "Tag": [ { "name": "43-156-228-149", "colour": "#47702B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xyzblue-dpdns-org", "colour": "#BAA83E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346756, "uuid": "6f2f801f-4cbb-40bf-9931-83d16487125f", "comment": "Malware payload", "value": "141079d8a6328c9764c1c74934fb6c9d5c9db12cb558e2da827dc45da7dd45f5", "object_relation": "sha256", "Tag": [ { "name": "43-156-228-149", "colour": "#47702B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xyzblue-dpdns-org", "colour": "#BAA83E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346756, "uuid": "f13a9f59-59bc-41c4-b6fa-c2b55d4dbd46", "comment": "Malware payload", "value": "96bfc913dc795114f14cf8a9f1fa26821da80364", "object_relation": "sha1", "Tag": [ { "name": "43-156-228-149", "colour": "#47702B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xyzblue-dpdns-org", "colour": "#BAA83E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346756, "uuid": "1bddd52a-f944-4de4-955b-255ff7346498", "comment": "Malware payload", "value": "4c5afe201534f2f222c3d48d7cf3d6d9dd2a7f03c9f950b45986e94fbf8a573073aec7a634f2046c893890bc1a83e098", "object_relation": "sha3-384", "Tag": [ { "name": "43-156-228-149", "colour": "#47702B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xyzblue-dpdns-org", "colour": "#BAA83E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346756, "uuid": "d0298da5-73d9-46f1-9355-d58056ad0769", "value": "T1C4627D206CEB10CDF2379B751BDCF9FB09A6E4A5292E72F421419A844B71AC4C863E75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346756, "uuid": "f379a573-69fa-4044-ba63-09aa954aa050", "value": "384:YcpcEJ0cgPC56cSzoKMAkkTinWpotxN2kcuyfWCAVPkcqbckDHcLHiSywBY0RkE9:YcpcEJ0cgPC56cSMKMzkTyWpox2kcuiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346756, "uuid": "f365eb48-1f72-4439-bf04-8d82b619a3d3", "value": 14692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346756, "uuid": "98da5772-7fae-4ebf-a96d-80e377920172", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346756, "uuid": "5bfb48e7-8144-4448-af9e-0e49cc3127ea", "value": "AFC_Security_Report_2026.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bbc823-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369462, "uuid": "171560d3-30e5-4598-ab09-344eef04d820", "comment": "Malware payload (Vidar)", "value": "53d8e052dca206680a5e3a4dd65a30ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369462, "uuid": "3d24f88a-ee44-4eeb-b1ab-230aab9045bc", "comment": "Malware payload (Vidar)", "value": "14116dc0a5060f283a3360e3346f23c54cacf583447b44e5c68e518a801c4c7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369462, "uuid": "67736770-2a91-4026-a692-57b695d72cbb", "comment": "Malware payload (Vidar)", "value": "a1123f63357864ae321fb61b4b52e0d3b7cae91a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369462, "uuid": "f24ade39-ba2c-4dcf-8468-de724412b482", "comment": "Malware payload (Vidar)", "value": "6114c4dff348eaa7e14a7d5336dba9d0a4a22196a9097641ccaeeaf4993c1c257e73d343e0d978c6c9130aafd8acb616", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369462, "uuid": "7fc00eb6-624c-4b3e-a1ee-3e78b0a748d0", "value": "T19B52F88A71D7E0BEC2D84338D75A616AEB763089131E56FF97FC859037C2500A679225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369462, "uuid": "2de657ca-007e-4a3c-afac-968adc7d5070", "value": "de26b7edf94e4a571958e2e797393a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369462, "uuid": "16533f02-4cca-4e8a-a287-057c0ab0ae68", "value": "192:OmbrJ7+ufOFZoxVviQg457BQKQHXdRVeHQjvBHC/UgIzU3VgxV3Z:OmRKOOFmxVvii5SKQHXNjvBOUvUlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369462, "uuid": "9f1a5e79-cc04-437c-af7b-e17833046d4c", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369462, "uuid": "fd816563-8a14-4afb-ba90-354e01738ef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369462, "uuid": "284cce77-eeef-450f-a01b-a3e88bfb8ced", "value": "14116dc0a5060f283a3360e3346f23c54cacf583447b44e5c68e518a801c4c7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae640359-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786383673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383673, "uuid": "df5c44d9-bfca-48ff-9ac0-02aefa4e4d5f", "comment": "Malware payload", "value": "e9638bb06b2cad78c026a62af8c7ed4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383673, "uuid": "9f5b6905-a539-415d-8453-042e260fe3d2", "comment": "Malware payload", "value": "1429c59a338928e0934c019be499ca5325399b640faa5c4bd9fbb87efc4c970f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383673, "uuid": "0f57d7f9-6f8e-4990-a418-d73095d6559b", "comment": "Malware payload", "value": "8fce3399d027a683b1f3ebed018540ff8e5ca4af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383673, "uuid": "8ae059db-55ad-450a-bc24-5db37552989a", "comment": "Malware payload", "value": "fdbdbcce0607877a39898325853c62d77f4948cea266c6f65c5c8356c570f797de9d37332da2d7ca8ecd22dcdd20a1d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383673, "uuid": "7ca03bec-22d5-4b81-9790-f5c036e5fc38", "value": "T17633195ECDA369706EFE5DC587893521E132FDBFE64B1F75288CDEA104AEA318831910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383673, "uuid": "c4e913a2-e2d8-4f70-8c70-15c82053ad3a", "value": "192:c7FqhnIhELBoxCjMSUwaglu5RF9QMW5w5MpiLp6P0TsVfcXsDwwK/oPPMctKd+Aq:wycIK/o/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383673, "uuid": "d5c5124d-11a8-4f9f-ae2f-937e8899ba69", "value": 53921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383673, "uuid": "1c30b679-feef-4140-b454-c9f36a6faef7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383673, "uuid": "1b0f8552-39d3-465d-8067-9ba0a523a508", "value": "Comprobante de Pago.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd32b2c0-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340345, "uuid": "9557ad10-9e1a-45e3-8bc8-59d48c15feac", "comment": "Malware payload (Mirai)", "value": "657b1872dec2d03b374de735f82fac6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340345, "uuid": "bf0c1b04-b05b-4bb9-880c-53ae3f95b7f0", "comment": "Malware payload (Mirai)", "value": "143b6ba7ad30818ec9fb2a55b8d49afdc3e8ae58b09fe68cbaa20c1e82a2b3c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340345, "uuid": "c172febb-bac3-4a52-912c-f6d154300f28", "comment": "Malware payload (Mirai)", "value": "9086699672da5fc475468db4e0193e9a7dc88e38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340345, "uuid": "e493ca95-5f3b-4364-b3a4-d32004a9855c", "comment": "Malware payload (Mirai)", "value": "56f8604e0c0da5df82e973990fb803b1f3d87a484a52ddb8cae002131cd18b8f2753367c59f00548760b64bcb871fdd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340345, "uuid": "c6530024-a2b8-469d-bb69-9c47d99870c8", "value": "T13A746D8851F5F3DEE2C8F97953053C165872293630A3B296311FA6B753A62940AFEF31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340345, "uuid": "aa2660ce-62c3-4452-9e53-133bccd70f98", "value": "6144:Pa9va9CHJ/ckT3tOcU1AfEkvB6mOvczgt8I7IuZg0:Pa9va9CH1ttHbfEk0RvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340345, "uuid": "df1d3a08-e7c6-4144-93ef-9e2a7b61f6cf", "value": 362424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340345, "uuid": "32970409-5ec3-4ecc-a470-d3227f7edcdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340345, "uuid": "d6e694c8-fea3-46b4-bc15-0e8a1755141d", "value": "pid.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340730ed-9490-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786348249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348249, "uuid": "80aee2cc-3a9f-4df6-a80d-0f1dd135e3d8", "comment": "Malware payload (Mirai)", "value": "71714b188b4d09959396ee51cbc2e1b1", "object_relation": "md5", "Tag": [ { "name": "BotenaGo", "colour": "#A337F6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348249, "uuid": "5ef6ca20-7859-434a-9fd0-6291b33ebc4e", "comment": "Malware payload (Mirai)", "value": "1477f5b9462dc62305abc37ddb0da17327145edf2f7c691927c101e455435ffc", "object_relation": "sha256", "Tag": [ { "name": "BotenaGo", "colour": "#A337F6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348249, "uuid": "bcaf1b17-a26c-4104-9256-60cc99192e5d", "comment": "Malware payload (Mirai)", "value": "3f98e253410af6e5b353598d0381cb90b065508e", "object_relation": "sha1", "Tag": [ { "name": "BotenaGo", "colour": "#A337F6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348249, "uuid": "04faeaed-3b40-43fc-ae59-bab14bc8d04b", "comment": "Malware payload (Mirai)", "value": "7f971d795d5130263105d1795c01aa6788b7f09eb9a6f4a2e51269a4191f75d11f5eba0d14967502e62b0f9c7507c970", "object_relation": "sha3-384", "Tag": [ { "name": "BotenaGo", "colour": "#A337F6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348249, "uuid": "d3c71b28-3a47-4719-9c1e-17e9e5869157", "value": "T198566C13FCA555E9C0E9E2318A629253BA717C596B3123D32F50F7782F72BD0AA79340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348249, "uuid": "b427a55a-3cf0-4adb-9ec7-7f904633969f", "value": "49152:TCkr1Yzd6tEGPCFc4bFjEwlARYMB+iIw4V4bdTMG/nkXtgMBcoCDYM0JGwe3joF2:ekrWAu1914b4V4B4bWYfmd58vY5E0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348249, "uuid": "acb38f09-247b-496d-bb00-9c5a403f87ec", "value": 6201636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348249, "uuid": "163af5b1-db58-477b-a38e-aab2dffe93af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348249, "uuid": "be514676-a15d-4b14-96d9-e1b70875d4b9", "value": "massloader_dvr.new", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ebad30-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372245, "uuid": "7ebc1608-6925-4730-b043-d4d1627da8a1", "comment": "Malware payload (Formbook)", "value": "a40da71cf54e39119c521137355e69f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372245, "uuid": "c6021990-5d76-4506-ba7e-e9e25dd50754", "comment": "Malware payload (Formbook)", "value": "150362f0b726124b5bc18e892421582c841329fc555c298dbd4b61622b8b1373", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372245, "uuid": "f6bdb90f-dccb-468e-bd7a-7eb991ef53c7", "comment": "Malware payload (Formbook)", "value": "b70f69c14f252e83ceaecf3c5304918d8b35b135", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372245, "uuid": "415353a0-3ee0-48c4-87a3-28fd9c5fe1f4", "comment": "Malware payload (Formbook)", "value": "39276261273b3741ec3deaf94476a7e124e25bdcd5d1cf716b35a6dfd0aef3a57c07e84164a5ca595e555c2955312671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372245, "uuid": "d9710c6c-3f61-498b-bfed-439be146b53f", "value": "T1FF35229087D9C121DD9917BB19E2E3B00379ADC8BA26CB6E8BDD7DDBB5233400D25742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372245, "uuid": "81ab0364-63c0-42c4-8455-2d7517e902a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372245, "uuid": "29101279-a38e-4308-93d7-b110ab104a49", "value": "24576:DW+bNa0n1CWi3bxFXrjvia5+mBAvGXXTH:iejn1CWiPnmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372245, "uuid": "b03e8314-0121-4545-8ada-f3c8a47739e9", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372245, "uuid": "e1db83ed-5739-47d0-98b4-4a5135071870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372245, "uuid": "14119c1d-daeb-4104-9c3e-dc8347fe8b49", "value": "150362f0b726124b5bc18e892421582c841329fc555c298dbd4b61622b8b1373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb153b3c-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371239, "uuid": "92f5a0d2-865e-49d7-808b-831e2d6af321", "comment": "Malware payload (AgentTesla)", "value": "395a2b5ed3e2f1b84ffff5c5e78e9e24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371239, "uuid": "9118e054-53b1-43ac-bf9a-4343136dc55d", "comment": "Malware payload (AgentTesla)", "value": "155dcdaee0c38c0db66be4daf5f80a6428fd13e05d701b37697b596c8141c956", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371239, "uuid": "aaf588dc-dae6-492e-ac7d-fb1341050f10", "comment": "Malware payload (AgentTesla)", "value": "f7da5b9814adbee6ea39d82b036bbe9b7574536d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371239, "uuid": "3c95bfd1-b4c8-4e99-b2d6-a0390b8d2ba3", "comment": "Malware payload (AgentTesla)", "value": "5bb43990fe924bbeff5eac9f5271fd813abb949e63fea6c41da468ab3c2c049b3a2e6914b2c982de8c8677fde3cf01ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371239, "uuid": "685c33e3-b666-41f3-8ff9-4a73d12b8feb", "value": "T19F3512502348F613CAA567381AB0F2B913F95DDDA411D2068FEDACEF7D36B020A646D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371239, "uuid": "bf35affa-122b-487e-b6a4-5434d532243c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371239, "uuid": "6ab87889-e012-497d-8b8d-d4d7e7af4705", "value": "24576:PV/6uBVcrTIo2L2MtvrVzZQ0QqlfWOsuO79Oc:vB2EvL2MtvZzi0rfbbo9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371239, "uuid": "e9d4d79b-2639-4740-b675-f13964144bac", "value": 1163264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371239, "uuid": "d291a00d-97e9-4fa0-bb1e-94b7606a817d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371239, "uuid": "70d33472-c5d1-4bee-a7f8-001891b7a605", "value": "155dcdaee0c38c0db66be4daf5f80a6428fd13e05d701b37697b596c8141c956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f87633-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370906, "uuid": "7965db26-5bf5-426c-9115-ca1b3a21e0f6", "comment": "Malware payload (Formbook)", "value": "f980940a63d56553073283f42a3362dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370906, "uuid": "e63a8d76-f494-4ec6-9d43-efc6b24cb676", "comment": "Malware payload (Formbook)", "value": "1648a7d78c1db3487849d3c7142d934031a85eb99a8f7b79517ffc296b0974fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370906, "uuid": "b8e1b7a6-05e0-4243-8fa6-10774662c4cd", "comment": "Malware payload (Formbook)", "value": "2a6d137eff8fdef6e096786aa0088d7319bcc265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370906, "uuid": "9f2d739f-c1d9-4b62-9c3d-b6f3cfffd27c", "comment": "Malware payload (Formbook)", "value": "3ca959178f23e6e9376c1e24990b469b9f2adc7fa6c801ae7a029d389e808abd97162c3b0c71dd0d326511227c3010ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370906, "uuid": "d2be6e58-5c84-4b79-be74-21ec8a68e530", "value": "T180350254321ACC06C6935FB0DD70E3F415B91D98E421E373CEEA7DABB87A2867C16291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370906, "uuid": "dfc21bbd-1236-4aaa-a7b6-f61a65530442", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370906, "uuid": "722f2a50-eef5-466d-92f5-ac8f45493712", "value": "24576:A/jR6pFsRFxhwCu5aoawO/7wKMeiwF2lB0rkRTg7oNhK:wtimRnQyVF6BPhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370906, "uuid": "a21c6b27-867b-460c-833c-cc7428588d9a", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370906, "uuid": "3b7a4278-76e7-4004-b5bd-c2afd47163b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370906, "uuid": "073a7f0b-17fe-42d5-bd23-a68a7ab8ce65", "value": "1648a7d78c1db3487849d3c7142d934031a85eb99a8f7b79517ffc296b0974fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23a79dd-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370848, "uuid": "3af927df-b50c-43cb-b0e7-d46d5593931e", "comment": "Malware payload (Formbook)", "value": "4878bab2368e5d0097b2a9ead24d349d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370848, "uuid": "00a79d5d-533d-4ed2-8e5c-6c9ba65c4802", "comment": "Malware payload (Formbook)", "value": "16751184487fa5b1cfcc7943ac6219834c895568992a879498124b9a5cea11b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370848, "uuid": "55afd01d-2d35-4440-bb64-e3b0ec4ae14b", "comment": "Malware payload (Formbook)", "value": "c683c9428a80ed2a438b68d573d41b8ebe4fd703", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370848, "uuid": "d1af1f81-afd0-40de-95be-39c6c3b21615", "comment": "Malware payload (Formbook)", "value": "9dea6ab771f9da1e6f6e9cd551fd8601e85631155678580cb6fd51a1520f4846c3351e9e9616320429d12f3c232f8e38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370848, "uuid": "22f0bdde-0960-4e58-ba85-d5562dcf6239", "value": "T15C350254231BCC03C6D31FB11D70E3B815A95D98A915E373CEFAFDABB83A6852D21291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370848, "uuid": "c4d126bd-7ac0-4c90-8f6e-1fa20f5e1af7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370848, "uuid": "3a54c1a7-e2d9-4400-8352-97fadd7092c8", "value": "24576:GhjR6pFsR605ieMfR6C6TDF0+211othuwwrECb1f/tIg9vz:UtimR60Mft2hyOh6AU1f199vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370848, "uuid": "9ea3a88d-c053-4324-91b3-b7b03c6fb694", "value": 1143296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370848, "uuid": "b6340c37-efcb-4ed1-96d6-fed8c2e96c8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370848, "uuid": "d45f0509-8641-412a-b992-6278fd2f91b9", "value": "16751184487fa5b1cfcc7943ac6219834c895568992a879498124b9a5cea11b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce77b97-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368907, "uuid": "e57d21b6-003e-4ec3-8829-cc50ad3e3658", "comment": "Malware payload (Vidar)", "value": "82e99d6cb1bd620f118f5f3b074e92fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368907, "uuid": "0b054d3c-4ba8-4815-b1e5-1467dca384d6", "comment": "Malware payload (Vidar)", "value": "168e816b20a334ee0068b336d7f656ed0d50f6b9d1853c7ed69ce7be8be1a211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368907, "uuid": "81ec0a1d-07d9-475c-a054-f0686403557a", "comment": "Malware payload (Vidar)", "value": "1eb9223aa4bab7414c0c52aafdbbe4db0f665a17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368907, "uuid": "3734043c-e520-4a4a-99b2-70f7e71d9018", "comment": "Malware payload (Vidar)", "value": "e8ee97cfa8b6f03df128a95114d48288aceea8bcc26694df215ca67ee7903d6fc48a0e84ee9e33098f77d70cf94d736e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368907, "uuid": "dc2eeeb4-8f76-49a2-baac-6a88ef08c184", "value": "T187420BC9B193E1ECC52AC2BDDBAF07719F363080530E6FFF06D8D5546792211A964268", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368907, "uuid": "70afd948-06a0-4814-8777-02f3de5092d3", "value": "850ee0121fda1022e1c1de250e3e1e58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368907, "uuid": "2dbcfafe-5eda-415a-ac19-349a360397d5", "value": "384:ODeQcQTeaUHBzdm5QXQhkXsiDhVhO2IFlO:0eQcQTeFm5LOXsR24O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368907, "uuid": "12389e55-7024-4a39-b893-5c0bda98894b", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368907, "uuid": "8c0a2346-e5b4-4420-8179-633d6d5c380f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368907, "uuid": "6d277d7a-64c1-4e68-aed5-a62ff232de38", "value": "168e816b20a334ee0068b336d7f656ed0d50f6b9d1853c7ed69ce7be8be1a211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fad92ea-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369448, "uuid": "075dd310-ff2b-4aea-ac3a-8deeed1166a0", "comment": "Malware payload (Formbook)", "value": "ce011ac41a36d28795ef81afb2b15f3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369448, "uuid": "f5eae0f2-ceab-412c-a01e-317f8387139d", "comment": "Malware payload (Formbook)", "value": "169613669b6c92b3e6a94e724ee919f15b1e29168dae09dd6123d0f09654a2b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369448, "uuid": "5e4ca317-d259-48ef-9887-1e04687997b1", "comment": "Malware payload (Formbook)", "value": "757172bd22dc22efbca7edc7db04fa9c3bde92cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369448, "uuid": "9f4fa284-c1c9-4632-b16a-2f315f94f1fe", "comment": "Malware payload (Formbook)", "value": "4faca8e2ab89711f0a5182f288cacddab9eabe8559ef5d5a1c564775e18e460ab3564b34ef7198712611acdf3ff23a4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369448, "uuid": "a43a6d7d-e343-4311-b859-d0d8b191f8f5", "value": "T15235124CA70DD90AC4A157708D70E2FC066A6E5CFA21D3139FECBEAF79727560885392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369448, "uuid": "a83092a4-672c-47f7-8dac-ebf2047f7dd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369448, "uuid": "8cbe5d3b-06a5-463f-8f13-e8f39f2859fb", "value": "24576:kXjvV0LcDHTxrWvJ013WBRysPPCSiDgsTx44J92:kXjN0LcrFr+K13WBdPMva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369448, "uuid": "c8bbeb2c-21a6-41d9-935e-ab5c786e52ce", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369448, "uuid": "5328da87-4c58-490f-90bc-23b603d3d0c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369448, "uuid": "c37ef103-c53a-49bb-87c0-c7a5d3f1e862", "value": "169613669b6c92b3e6a94e724ee919f15b1e29168dae09dd6123d0f09654a2b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71805abc-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369397, "uuid": "aa269970-4041-4c08-b652-d9a84225d3db", "comment": "Malware payload (Vidar)", "value": "c39452e4c2422eaed9347dc01927d750", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369397, "uuid": "6ad2d40e-6f97-49a8-a38d-f7ad0fc8c7e4", "comment": "Malware payload (Vidar)", "value": "16a0463ca3974678c43689903df41dff75795ffb8268af7fab97c143d3d1752e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369397, "uuid": "d2a32cfa-79e9-4ad9-81fd-d4ab2d48bac8", "comment": "Malware payload (Vidar)", "value": "c9bb3c156722a781a0bc718894e7fd5436bcfad7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369397, "uuid": "bd9151e7-9fc5-4fa7-be1d-9fa7d854750d", "comment": "Malware payload (Vidar)", "value": "a120e5db7b456a3cf39abef6ce5927f188ced2c59ab8a0b5ca81397cb17e433c76e224264805fe4d043c92615b0c8cb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369397, "uuid": "21876805-0592-4aae-9a5d-80f33c48f131", "value": "T130521AC770D330BDD2A9C3BCCA9F2676D662348013264AFF15EC869416C39117978B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369397, "uuid": "08168301-cc19-4bfa-917b-672539ca55af", "value": "e23bb1c08602479266491150dc857434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369397, "uuid": "5def5f2c-011d-46ec-8e6e-8457b8349678", "value": "192:O9vU1VDGvFPHBshmTv5ea4xtLJCyQkxluldsgVbj03V:O9vUfD+P2hK0a4xtdLQddsgVbj0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369397, "uuid": "10d99348-727f-419e-a640-ac06825bc6bd", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369397, "uuid": "972b67d5-f1d1-43dc-bdd8-d10a363d60bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369397, "uuid": "2685e339-6652-4a38-8a23-93f10ac434ee", "value": "16a0463ca3974678c43689903df41dff75795ffb8268af7fab97c143d3d1752e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47baf986-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786373193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373193, "uuid": "275b942d-f9a8-4aa6-b5ef-f530774edf87", "comment": "Malware payload (RemcosRAT)", "value": "d337760cf94c2c593794a35b9c825a10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373193, "uuid": "0f871b56-fe14-4b30-a6b5-5e722baa15f0", "comment": "Malware payload (RemcosRAT)", "value": "16a5e7478afc842e882cb5115853e6c2bbbd112d985e679752dc51c3a4720bee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373193, "uuid": "b667fa82-c338-42eb-8a42-e6807b87617a", "comment": "Malware payload (RemcosRAT)", "value": "480531c4cf3384b1fd0907449dd57ace63c4b314", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373193, "uuid": "e80dfa8b-a1a0-44be-992f-a7166172c558", "comment": "Malware payload (RemcosRAT)", "value": "e97a1cc898abd133a6062d968a7921c4daeee8203c4926f838425be5fd55ad5d4bf9a356517b858ec751a1b428812566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373193, "uuid": "fdf9fe9b-34a6-4062-8491-d8d82b431177", "value": "T13A552359D1818123DA591ABA2722F33537B8DCED3830E205C7DC6DEB7E83FA28955163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373193, "uuid": "ac585992-7918-418a-84dd-e85538c2d682", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373193, "uuid": "13b958e7-6dab-4b8c-b20f-7b1a95f6aee1", "value": "24576:QHBYg+g6KSa7dYIiik78MWH8hYBXUQhwHsAgkat6+04HZV2YoIHBYxHBY:UaLMSa7dYIPvMWvxx+MFR3/V2aata", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373193, "uuid": "b96d09c5-0158-4cb6-ad92-009d67cb3fff", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373193, "uuid": "5357b768-3bfe-4379-84e9-aba9d60cc16c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373193, "uuid": "f41fe6b8-bce8-452b-b1f2-ac6f981011fa", "value": "16a5e7478afc842e882cb5115853e6c2bbbd112d985e679752dc51c3a4720bee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a446b7dc-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370771, "uuid": "cee979c3-8a2b-4838-85c0-5a4b7a126318", "comment": "Malware payload (Formbook)", "value": "cc96c83e52e24db1eca09d1eae3ee89b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370771, "uuid": "7fd73a13-791f-41c1-abb3-738d9ea1333e", "comment": "Malware payload (Formbook)", "value": "16b77ec1264f00283bd08b00a72d652f4c47835c35bc906d8ba0906cbd371eb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370771, "uuid": "1e34ca52-b2e5-440f-8c52-2419040b4349", "comment": "Malware payload (Formbook)", "value": "47faa2416c811e991c736c9919a6774e75aa10b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370771, "uuid": "b17bca8c-d23f-4576-86e4-df5dbb00b4b2", "comment": "Malware payload (Formbook)", "value": "4a8d856f092e9500220b71eb74e9a4289e4c83f9607ff509b202ee402fda966bd2117b2d904aeb526ce7aea66be0ab0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370771, "uuid": "5c3c9b19-22f0-44dc-991a-2bb9e83229dd", "value": "T1DA2512986C02CE16D0870BB18CB1F3FE56741DDCE911DA57C9FDBEA7B8356463908A82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370771, "uuid": "78859ea5-1716-49b6-aad7-50bf7e5a02fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370771, "uuid": "f4020e66-e806-4390-8ecc-7e6a6df5ff66", "value": "24576:4a/cWX+LfHUBJ2i52xH5it8Ih77DqVS1jt4ACWq5p:4a/czU+ikit8IFDqgFt4ACjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370771, "uuid": "acc09ee3-2b25-43b5-9e3f-e2f023406b22", "value": 1034240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370771, "uuid": "4ee9d6b7-7cc6-497b-a451-4488e0e799da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370771, "uuid": "af41fed0-aaef-4d7c-ba53-43f5d63cb6d5", "value": "16b77ec1264f00283bd08b00a72d652f4c47835c35bc906d8ba0906cbd371eb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dac18fa-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371028, "uuid": "854e8c6b-88cc-47d2-983e-b33fe4cf049c", "comment": "Malware payload (Vidar)", "value": "a03852c13e239a610a6f55903069e328", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371028, "uuid": "5b7a6720-4919-4e72-8dbb-ff8419fe1c28", "comment": "Malware payload (Vidar)", "value": "16fa8f51c81b23a22433640d4a5e5280bd99b984fa14899987678596fa9c272d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371028, "uuid": "afd6c797-82bc-42a4-a818-ff1cbafb73ba", "comment": "Malware payload (Vidar)", "value": "f5b30939c25b1b38217fe6adc535917742dbe3d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371028, "uuid": "f0b16c6a-4345-463e-83f1-4416d7081097", "comment": "Malware payload (Vidar)", "value": "21e9a1750a441ae8b7c838019b1d7bef96cd9b74ec683e26c766251cefebf5d639acaef560f55d4aa0dcb761662f1ee5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371028, "uuid": "de223e3d-a7fd-4ee1-8bc1-4b1b5ef140e1", "value": "T1EF929746E11BAAE4C4D9C7336366526751FCB86022356B3B9FDCA93A4E42330E7502FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371028, "uuid": "a2713ae0-9759-41ec-8be1-cafef15ff605", "value": "a6c2466568aae347b94e75c85d9c3820", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371028, "uuid": "f7f66782-8550-4eef-b1cf-e882d636b2bc", "value": "384:OMFNkOUeiKHYpxgx0yIBOTaDVijHNg6KzFhq14Ur0K11KlsNDKYT1TCsCg:7rIxgx01OTKiNgHMMEGsNDKYT1TCsCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371028, "uuid": "6e3aada0-163e-42ef-a6bd-359b63152fbe", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371028, "uuid": "494ccad7-f623-47b5-be2d-0c1a610df535", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371028, "uuid": "45503d97-272a-4705-a2df-1a0abbfe246c", "value": "16fa8f51c81b23a22433640d4a5e5280bd99b984fa14899987678596fa9c272d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0fe0887-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786345908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345908, "uuid": "6b7b8b17-938a-4d22-94a4-8a095d8d04ab", "comment": "Malware payload", "value": "065986a4e27072462709eae186c20ab3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345908, "uuid": "f9c32bf1-c7e7-48c4-9eb1-56273a08f28d", "comment": "Malware payload", "value": "176b4609c03ed36488e941da7ce8fde7519eb0b3376f030c30114251a93ec85d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345908, "uuid": "bb7de28e-e819-4f83-acfc-b125e1d958e0", "comment": "Malware payload", "value": "9ad9e73a7c817b9b8492861232fd77af73c48c37", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345908, "uuid": "0a8e1915-9220-446d-89e8-2905eba84df1", "comment": "Malware payload", "value": "5ac34a0eb99ef76681d03180a86dc64bb2811796f38f7ad5ff30421efbb4bc3344333e3d304027f22104ceabab4da78d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345908, "uuid": "d8200510-b604-4f7e-ac09-f03fdcdbd02c", "value": "T120C28D966A867C40BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C15FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345908, "uuid": "ccbc3d51-0d20-401f-a21a-fecbcc532c78", "value": "768:h8vCB+25j6es8R7x9FYpMSUpi+20qUpi+20YQX:h8l25J7nd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345908, "uuid": "95ca3f95-4315-411e-a9dd-f22a27bc9855", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345908, "uuid": "cd4b7fbc-52b8-462b-91a4-a98084311b04", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345908, "uuid": "3e01a6db-59ac-48ee-8a18-806729306258", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8f531f-9496-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786351030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351030, "uuid": "1bbb6c42-a839-4f23-98c0-d81a5ab690f8", "comment": "Malware payload", "value": "bbd8bf0f75f7ae3d321656b5ed52fd66", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351030, "uuid": "b6c8cab3-993d-4989-8e36-5cac4c44028a", "comment": "Malware payload", "value": "178528e57e2f085bd6d3d7c3835dfb02658c744d6cde82c1eedd606e16d1815c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351030, "uuid": "4a5bc7f9-10ee-4b59-b5c0-5ff58ba443ca", "comment": "Malware payload", "value": "ebbe5ebff2ec8c79ccda033e157433d1542d2895", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351030, "uuid": "b2676cf1-905e-4026-b209-1fc7161eec7f", "comment": "Malware payload", "value": "a89a7963adad06ad341feb777d2fd0c3bf2c6581abf2617e3751132a8d4e2cc17366cea300dd45b1c7d8e7bf11bae21f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351030, "uuid": "fec14ac6-ebe1-4843-b469-f78591885290", "value": "T1884423CCBF280353C5CE4BB069371776127D6A22E556556C2BC288C78E593F320EE9D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351030, "uuid": "77c98fba-b6ab-4406-9aa7-178e783801bb", "value": "6144:7mWti6kB/2A/KR//6Tq7YA8O/ugfJDLEWXmm3GqonT/0pGn:7mg22AIKm7Y8JJIq2T/0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786351030, "uuid": "7a3f30d9-c122-4913-920c-aadb257aebfd", "value": 274012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786351030, "uuid": "e71946c7-05f1-4b8a-957d-72bdd14acdd9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351030, "uuid": "d860fccc-c320-477c-8393-33d9bf9b630e", "value": "Hopeless.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d0769c-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786374107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374107, "uuid": "e3bc54e1-0b6d-426d-a4e9-312c6bfb7ffd", "comment": "Malware payload (AsyncRAT)", "value": "2d855f570a4f542ca7b32ae5f083b20f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374107, "uuid": "49cb82ce-094b-46a3-84d4-170d26dd3985", "comment": "Malware payload (AsyncRAT)", "value": "17ae3de683fef60af0d8533cc4a7f04d302846476377c40e324b98630d835364", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374107, "uuid": "b7120157-0eab-4899-8c85-ac05b82aa57e", "comment": "Malware payload (AsyncRAT)", "value": "68e3f0ade6da737bdca9db927c322bf6da6a3aa9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374107, "uuid": "dc433bae-46a2-48e8-b700-d68fcdf76d07", "comment": "Malware payload (AsyncRAT)", "value": "e9e7921c42e5c2854ae78fe7f6131f337b849f45a1dbcd93472e041a02ebc425d9b8b69c61542f88580ddf82d8f4d493", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374107, "uuid": "40a56cab-2aa5-4998-88f6-a2a3d5428d25", "value": "T11C1501447A09CA03DAA503B94A72FAF807BD2DA9E412E7174FD9BDEB7576F004D40683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374107, "uuid": "5706d459-2816-4d13-9621-d2517e6c2e27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374107, "uuid": "1ff07bb3-6c7d-4c03-8746-c5e35afe582d", "value": "24576:JgeA9s4HavBK7YoE9pvl/RzTtNHciwWd+ceZ:bUs46v4coE9dT5Bve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374107, "uuid": "b5f6e237-9e56-4713-8e63-893cfe17caaa", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374107, "uuid": "119e3789-050a-4c30-b9c7-db17d87bccf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374107, "uuid": "b6743d5d-52d8-4567-b642-7f1ec03cb9ef", "value": "17ae3de683fef60af0d8533cc4a7f04d302846476377c40e324b98630d835364", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5acb702d-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371936, "uuid": "ba03e3de-a5cb-438d-8860-ae4b29cb2a39", "comment": "Malware payload (Vidar)", "value": "544482f7cc6c2368f454d66950bcc623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371936, "uuid": "cf288438-d6a0-44c1-9606-05bd7185761d", "comment": "Malware payload (Vidar)", "value": "17c4b86c57f4e8d06c8cd2cc5572f34179c70454211809b2f440d0c05ecd7f71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371936, "uuid": "317ce66b-6f51-4fa3-adf5-29cefb6a3c59", "comment": "Malware payload (Vidar)", "value": "71db7a8f1bb2a5cbebd279f98ba8d6a34e9a3226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371936, "uuid": "0b4f618c-4a4e-4096-b19c-fb92c9cc2851", "comment": "Malware payload (Vidar)", "value": "ca244e494ce77f8f2a3b01e66794eabec3b4893e8a5da4be1bcc1f40addd3c346de5e4cef5fb2b2146d295b76d3bad00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371936, "uuid": "c5b805da-abbb-4288-a466-b1fa8a028833", "value": "T1BE520A86B0C330F9C43AC379D74653A3DAB6707812394BFF6BDDA5691E619103EA8748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371936, "uuid": "d7b1a64e-8303-4278-8592-30e948561662", "value": "258d7cca1a45fc76d070b638c4790e6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371936, "uuid": "4517f47f-a1ad-48ab-9a9f-432b647f85dd", "value": "192:OjhXcb6jS/puejOZSi7YMTvcxflOksV4WUw5reCw6CG69fZmDVvTRtTt4D8M7mtG:Oj3D4uksiWUsqCw6CG6+Vt4gMZa9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371936, "uuid": "940fca4d-f229-4c98-8b1a-ad43207c0c1f", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371936, "uuid": "cbbe86c1-d1c9-43a3-9192-1fad985c541a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371936, "uuid": "a03a4b0d-b3d6-4d7d-986d-9b193c425828", "value": "17c4b86c57f4e8d06c8cd2cc5572f34179c70454211809b2f440d0c05ecd7f71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4ecbbd-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786368474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368474, "uuid": "581ca5c8-99f4-4f17-877d-169c882f0d17", "comment": "Malware payload (njrat)", "value": "ea9d1eb976a0c3f31af8135b1c866f40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368474, "uuid": "69866ab4-b058-43c3-a1b6-ba827a2c4830", "comment": "Malware payload (njrat)", "value": "17d0592471da13264ac2fb8db05ecc7d14ffdcb50e316dbecb1d97eb145f4efa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368474, "uuid": "d89b390e-b4eb-46b1-9e0c-00f007d5a859", "comment": "Malware payload (njrat)", "value": "50e41303205b2ded9f95435ad5fd2ef928fc1454", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368474, "uuid": "7c2a0782-8832-4891-84e6-40eaa4f4f789", "comment": "Malware payload (njrat)", "value": "746cdfc031925632d72e5b8bc883ffcff6201277bc36ef7ce7ae772e5f21d1a6292907ae277a6997d7ca8e15eee01135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368474, "uuid": "51bcdc67-ffba-421d-bcc5-48614bede33c", "value": "T1E11501C03B39B71ADE5516349534EEB501FA2DA8B011F9E26EEC7B4B75AE200AD0CF51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368474, "uuid": "2ba64b87-c6a7-435d-af54-8ed6990a967d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368474, "uuid": "ef7db2b4-9708-4606-9d19-8bafff6b10fa", "value": "24576:V1BaXrAQVIKQDTNDPNKWuJBuBpHESQDo/O1:VK0EIK85PNXuJBOHESV/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368474, "uuid": "2cedd302-e6ec-4972-9a21-41b025f0ee76", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368474, "uuid": "cf1f4ac9-da74-4bc9-81f8-35e1742c5d63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368474, "uuid": "7901a185-9f79-4977-b665-f1802470ee07", "value": "17d0592471da13264ac2fb8db05ecc7d14ffdcb50e316dbecb1d97eb145f4efa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c15ef1-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786373186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373186, "uuid": "078758b9-217e-46a7-b3a0-30ee876305e7", "comment": "Malware payload (PhantomStealer)", "value": "df9327fb180bd3622b2dfe7251687ec1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373186, "uuid": "b1391a51-c96c-4043-bcaf-d191302f74d2", "comment": "Malware payload (PhantomStealer)", "value": "18251c266fc7315dc0f437c1fdbcb71b6f65b776cd6bea7d3418d79fd47a1a97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373186, "uuid": "8968c110-73af-4589-8e2d-982dfea573d9", "comment": "Malware payload (PhantomStealer)", "value": "cd941ada21580c2489007e70f3db294b3f1eb43a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373186, "uuid": "6f662905-f21e-4833-991f-63bcb44fa191", "comment": "Malware payload (PhantomStealer)", "value": "ad891819ac62f9bf4d07627c14c17f91087a17ded5e3fe3de830160bf3804db59483ea3f048d7403a3e7d21be271092f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373186, "uuid": "be8db21e-4082-4440-a244-cd52ccf2b8fa", "value": "T167F4DF6873F85A00F1FF5BB294B59D51AB35B513A961D71E11C081C80E72B918F8AF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373186, "uuid": "d4ace265-7ac8-4fe7-bf72-59c4bac5991c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373186, "uuid": "d6c00f3a-41f5-49fb-98df-34adfa011651", "value": "12288:H9qNWvkqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQabm3NUW6:H9BkqjVnlqud+/2P+ATAS/JYec3NUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373186, "uuid": "e7dcc79c-cfd2-4e87-9dbb-854e600b9e97", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373186, "uuid": "5e2dd737-9d0c-4adc-8c5a-79989493957b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373186, "uuid": "25c058a7-a03f-416b-b4c2-0c367a34e597", "value": "18251c266fc7315dc0f437c1fdbcb71b6f65b776cd6bea7d3418d79fd47a1a97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1613ec-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371076, "uuid": "8f9026a1-b4b7-4ccb-b218-fd167199a547", "comment": "Malware payload (Vidar)", "value": "d36fbbe6610cd367229563c98128c47b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371076, "uuid": "c0f44588-7360-46ed-8d0f-e87830fa8151", "comment": "Malware payload (Vidar)", "value": "182bd3eb390e7b4d4d4f36d73d40fa88d51384b099a22e27c09e71c72c19593c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371076, "uuid": "b7bc6bb7-9042-4091-815a-da94d43d83c7", "comment": "Malware payload (Vidar)", "value": "6d5b456a85978b8bf144a044106635a06a2b3142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371076, "uuid": "780d0397-48bf-41ee-9cb3-b9dc2c806a63", "comment": "Malware payload (Vidar)", "value": "ce13d02b2dc010a3312a64e48abbda249f354a6bc559b76a9b0781dcad351f0215523c759c6d2c70a1568c8ae4ac3c9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371076, "uuid": "ebb76376-bc56-4170-9ded-c019d3da4018", "value": "T1324209CE72D7B4FDC12AC6B9CE1F127B9B23709503164EBF82ED4994A7C16103A74914", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371076, "uuid": "ccb65c2d-d299-4fb3-8c0b-02ee97a69e4b", "value": "e83ec31e160bc53e897e6b25acb9d1af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371076, "uuid": "4c7c6f42-4947-4b5a-b96e-db1e7516bcba", "value": "192:O6vr7SdmsSysdqdWvsRanfDVia5qeEKlRtQslGtLPg8q3QHf9v3VYTM4F:O6z+dmsSvdqdATDwmqelH2LPgnkfFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371076, "uuid": "00666527-956e-4db0-a7c2-a3a5968b6407", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371076, "uuid": "e18e6c2c-8eb9-496c-b297-91d62453db18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371076, "uuid": "79a84bf0-bc01-4c13-928e-c681f5be5e52", "value": "182bd3eb390e7b4d4d4f36d73d40fa88d51384b099a22e27c09e71c72c19593c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353b767b-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (PythonStealer)", "timestamp": 1786370585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370585, "uuid": "9fe3f676-b1af-4bcf-9829-d7ea28047ee1", "comment": "Malware payload (PythonStealer)", "value": "430626a11bb3eed673c5113a524c2145", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370585, "uuid": "b3d10cda-c8b4-470a-9732-5b8c4a5eb844", "comment": "Malware payload (PythonStealer)", "value": "186c53235eb7dc530821c7266c3e973ec2d3d692380bb208481a9418ab728cd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370585, "uuid": "bfbc0c7e-4020-4793-bf68-02224bc4f582", "comment": "Malware payload (PythonStealer)", "value": "b454461d1b8e3c7d64dbf050df4fa7aee9d6eadf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370585, "uuid": "7795a431-c630-48f2-b675-4d9b3d6973ed", "comment": "Malware payload (PythonStealer)", "value": "9a881fd7257d871c42d8a5e282a3a25373d16a5f64e3672b02a59cce6912b8e3b2d5e217e1afb071e20039eb399fa453", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370585, "uuid": "347caf14-3f22-455c-b810-514baba468e6", "value": "T122763305C3A319ECC5DF90B0E69AADA0F1247DECA332D17357A087723B6BF6149253A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370585, "uuid": "5e5283ca-ee4b-4528-bf04-d280cd69d7c6", "value": "fc3b0de2e7f988c46ed9c8e46a804071", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370585, "uuid": "3dc644ec-dda2-42d4-b7a2-26f7e0259b54", "value": "196608:LNlGu+OUFcKFUezvxY/fk8M8IIx6QlW/SV6jMXm9vnE:iF3Vv4f0LIFvAhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370585, "uuid": "fceda0fb-d43e-48b4-ad60-e59831ae05ce", "value": 7153664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370585, "uuid": "7f6b8b83-bfed-4ab2-99ed-a24f0f913390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370585, "uuid": "62574bed-4835-42f4-bd3b-1867489ef7bc", "value": "186c53235eb7dc530821c7266c3e973ec2d3d692380bb208481a9418ab728cd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72358f0c-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371976, "uuid": "46100384-ede2-423e-8ecb-1eb0981502f3", "comment": "Malware payload (Formbook)", "value": "152c69c61cbc5018939e456cb5e16b02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371976, "uuid": "d2a132c5-ddc9-40bb-800c-561c11cb780e", "comment": "Malware payload (Formbook)", "value": "188c4b2e0362e9b5377e429dede079f8fdd80094cb9706a5fd826e3704f6bd2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371976, "uuid": "aed88725-6eb6-44e7-a29b-a33c257d672a", "comment": "Malware payload (Formbook)", "value": "2d5c4b86ac0019b5575862200f511267787e44a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371976, "uuid": "b43be9ba-7355-4823-95c7-e7ec4802a8ae", "comment": "Malware payload (Formbook)", "value": "8796f183fcb95a8d138bd8f587d0b2a47e415eaaad3b36293434234b7a59e6a08e971a85728c5927a2ebbf250f171726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371976, "uuid": "7ed177a8-0ecf-4902-bdda-5102e93e3ae9", "value": "T144252249B70BE603C50527354BB2F27523AE9FE26803C22767DD7EDFB92AB199C40251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371976, "uuid": "09de715c-c653-4137-8ebc-852125b0aedf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371976, "uuid": "aafa862d-5c01-4379-9317-254a45bf1ff3", "value": "24576:FMX/oG1UWLgrtZYMy0tbQlfX42mb6/VOtM:FMvoG1UDZy0tEhUbyOtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371976, "uuid": "5fcca09a-c63c-4d2b-80df-5a5e0bc39894", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371976, "uuid": "576ea1ac-26df-489c-ade7-434a0adabbc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371976, "uuid": "e5acdb9e-59a0-44ce-91c6-0b0858419f4f", "value": "188c4b2e0362e9b5377e429dede079f8fdd80094cb9706a5fd826e3704f6bd2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4a64b9-94f2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786390466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390466, "uuid": "62b33284-a43b-4543-b8c1-13a8d125b45d", "comment": "Malware payload", "value": "76bccab7973ea4e8d64d3dff84a1f64f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390466, "uuid": "662d1da4-88a4-4c36-9b3c-796c09f3eb96", "comment": "Malware payload", "value": "18c63349d94f99911879da995d0a1189a982311d15a2bea45bbe181bae2f8db5", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390466, "uuid": "f521aa19-768a-490b-8398-f080b4651f74", "comment": "Malware payload", "value": "41644479ae3eca18562946d5f0f1bfba59ec4495", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390466, "uuid": "f3976df2-61d5-4e6e-93bc-5c2fd4917142", "comment": "Malware payload", "value": "be2d0688f19f2ac410ac66e28a91d7490ac831e5d280c94cf87165d7495e70256ccdd02a07f0c201a5d51765f7edd400", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390466, "uuid": "5e816560-1730-4a47-88dd-0b5d6c5f475c", "value": "T1A942F68CAF8063B4F29703DD77AF2999132561CB544CDC80F64C5DE06F4B78D4A56E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390466, "uuid": "5b7e406f-bf5d-416d-8d36-b96e64659f12", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzqlX42AiYOpzfMqY6Zl9CX:sXX+/DV7k/3qlLAiYOpzEYT9CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786390466, "uuid": "5e9d36b8-ea8d-4135-aeec-19293713f69c", "value": 12044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786390466, "uuid": "7a4cf227-fd02-4eec-bcc2-dc968635a784", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390466, "uuid": "cd843451-1236-4345-91f7-ae99930f9d97", "value": "ttt.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb42ed7-9504-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786398218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398218, "uuid": "3c6c9d50-c16e-488e-a225-7b77536a2034", "comment": "Malware payload", "value": "f76fc5ef54234f4bc44ad169596b9444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398218, "uuid": "6bcb2b36-3bac-47d5-b65c-cc37410462e2", "comment": "Malware payload", "value": "18cb678157f4b65ed79a60bd50300f1f9894d36ad87434a1a13e231585e439ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398218, "uuid": "3ef3cc83-f610-447d-a1bf-661e9dc6c032", "comment": "Malware payload", "value": "611a471bcf705e6a9f80911dc97c092f4f7d3f51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398218, "uuid": "fb964150-e2c8-46d6-b574-1c5c1a5f89e1", "comment": "Malware payload", "value": "1f56fc3a82f8013072f64fcd41227f93582e8507f48e60167368ec2239475ab40275b65bb5e73943da7d8ee335076cf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398218, "uuid": "b9fb3393-7e4c-4a32-bf1d-00ac64274b97", "value": "T19BD523DAA1B61974D023C776EFA2E07D716C7B985661CE4BF7CC69108C43288603E3B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398218, "uuid": "a755e65a-2157-40e8-8140-e336792d8b27", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398218, "uuid": "b8f05cab-b540-4020-b09b-03a434cf46fc", "value": "49152:7IFb9DPOYQog1pWkDkqHiakxyGlt46AWIjLLAyHXr+KxVxTotoSvqBdNc7dbpO:0b9L3Xg1jV5kxyGlttAWIjL8mr+ruaOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786398218, "uuid": "981c22fd-1148-434d-ad82-50aeee59f07b", "value": 2894336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786398218, "uuid": "8f59d1ad-6b74-4741-bc20-aaba5a207d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398218, "uuid": "8957d80f-ba4e-4011-bed0-217a8633fb52", "value": "18cb678157f4b65ed79a60bd50300f1f9894d36ad87434a1a13e231585e439ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e7704e-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370697, "uuid": "ace41770-1244-4259-8239-778b633358c1", "comment": "Malware payload (Formbook)", "value": "9559e837bd0ca6ef8277ed2c2c4cbdf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370697, "uuid": "df125c5e-bb63-469b-9cc0-7be10293fc0a", "comment": "Malware payload (Formbook)", "value": "18db6ccd20d52de376dd642bb304674230ecbcdf3c911e4e0f2ca67f27c40fed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370697, "uuid": "342c4fd1-0c53-4989-b727-f72100ce3d80", "comment": "Malware payload (Formbook)", "value": "49c6603a3c420123aa8231719441c53de3d366ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370697, "uuid": "ce508c2a-2401-4d6b-bb99-7b812684356a", "comment": "Malware payload (Formbook)", "value": "aa36cf9d096136f9f185cd5b1409a789569e0f78d783f20bef57a48b341110fc9a769404d377bb9f081e024855531cb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370697, "uuid": "bcae6d5c-807a-4341-a7fc-8d3aafd35be8", "value": "T1C83512002A8ED801E0E7577594B0E73913F7BE5DA521C30B8FEE6EDB3A26B015D147A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370697, "uuid": "76c8035f-97b3-4fc3-9007-61d1a536afb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370697, "uuid": "0bfde0cb-d4e4-4f8d-8dd3-7f972a890017", "value": "24576:aY9q3cyWcWaXto7ub2hHHNZhaQreRrfuHSnpt8rAYDBuK5OXZiyylhG2:T03TrWaXG7Y2tHRa2eRrfZnpt8rACB+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370697, "uuid": "67e5c375-863e-4605-afaf-51f1da176466", "value": 1135616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370697, "uuid": "4d91125d-7f60-4b4a-8f31-10a33ccd206d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370697, "uuid": "5aa2f5f2-31a7-4bda-b0d6-9a8db095a177", "value": "18db6ccd20d52de376dd642bb304674230ecbcdf3c911e4e0f2ca67f27c40fed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7c1a26-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370894, "uuid": "ac8f3612-e52a-4d0d-bbbf-be8961ddc809", "comment": "Malware payload (Vidar)", "value": "33b47569f2a5d3740158ac490a377db5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370894, "uuid": "7c584cd6-89cb-4ba1-b7b1-38ab850926b1", "comment": "Malware payload (Vidar)", "value": "18dc508590e07a34461a1d931167b6be9f3a44771c15583289c5547059a3ce12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370894, "uuid": "8f7e1094-686b-42bb-a6c5-87799ea930d0", "comment": "Malware payload (Vidar)", "value": "44da682acb2bfaf9da75e2c12bc6a3ffeaf51c7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370894, "uuid": "89d5faf7-8d23-466e-87e3-7cac019593cf", "comment": "Malware payload (Vidar)", "value": "915c660c376e7f536b859b197b9f74bd91c4a3df3ca4bcb863fa5e9cfb47d2563c5b8f78709645a71683f2ef9941215c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370894, "uuid": "2732be30-6f26-49d7-a7ea-df19861a02ca", "value": "T1715219C2B2D3A0BAD428C37CDB9A16BFE67530851A1F6BFF06DC97542BC261522F8544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370894, "uuid": "caec2acd-fcb8-4b3a-93db-252ee6e546f0", "value": "11947076675cd2ccb7ede65c6ece700d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370894, "uuid": "3524a754-6bf5-435e-a182-846770a0ad47", "value": "384:O4iAVQhVq7EI7fyaEa5btGpsK7N3vmmoLlY+cR:sDGEI7fyaEVpP7N3emoJY+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370894, "uuid": "8e0c77de-f2af-4850-a20d-b57d1bbc0fe7", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370894, "uuid": "14753f7f-5760-41fb-8c70-45d6dcb510b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370894, "uuid": "3d39d9d1-d7aa-4a6b-ad08-d5e3a046f1f1", "value": "18dc508590e07a34461a1d931167b6be9f3a44771c15583289c5547059a3ce12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad89723-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373332, "uuid": "bc455cf1-9517-4f4a-970e-b28a71aa8459", "comment": "Malware payload (Formbook)", "value": "af8c7bd23a3302f1f6e332895f377b8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373332, "uuid": "2bf8e053-1260-471d-84fb-22eba0ce2044", "comment": "Malware payload (Formbook)", "value": "18f6d316d88055a24c76b9a548ed4510819228c9fca2b3ba681a5c4a0e63ff08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373332, "uuid": "0a6638c2-108a-413c-97f0-b94de6c070a6", "comment": "Malware payload (Formbook)", "value": "1b417ef660c5a2403c2dcd85b889ddc00d449854", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373332, "uuid": "df468b10-d1b9-4573-a771-fd16df1bccbb", "comment": "Malware payload (Formbook)", "value": "00bdf9e3cecbca2a2c9808bbd6dad44885a903bdf05d339ebd97b2f1daa7c03d9d85ac62e7364221bd542c611f50c0fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373332, "uuid": "e5f3ce5f-80c9-4d39-b901-e55b9387bd35", "value": "T19D3501591316D911D0D687F6B8B0E33132741EDF79E3D2D29FEA6FF738682812964282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373332, "uuid": "dd4f94ef-31d0-4a17-9281-a4253768e223", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373332, "uuid": "dd622b73-9dd3-4f4a-8ae5-dc50d011a0f0", "value": "24576:Dp5028UeQnIEQqiwhceCleE06TIOmXReb64wMAY:DpNfIEQwcxev/Ib64Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373332, "uuid": "31dab52e-762c-46ea-8ae6-a068fa94f0cc", "value": 1095680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373332, "uuid": "55e3e972-ce4f-4218-bb17-8952e848e550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373332, "uuid": "4cca4948-050b-47a6-99c3-8d3a081bd296", "value": "18f6d316d88055a24c76b9a548ed4510819228c9fca2b3ba681a5c4a0e63ff08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be7714be-9508-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786400021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786400021, "uuid": "5116470c-b39c-40d3-8cc0-0208c8491588", "comment": "Malware payload", "value": "9144b289cac323da28e0d128723bb2be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786400021, "uuid": "3a51672a-0828-4d08-a098-87d1149652d8", "comment": "Malware payload", "value": "1904d30ecdb622d1e657e56973578d062e4f109c4e9913a6f6fd47eed34283ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786400021, "uuid": "d889fff3-b40f-46f7-8616-ba0bb32081d2", "comment": "Malware payload", "value": "5ca5c557834649e2164e595f2de44a66924bf556", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786400021, "uuid": "a349fb96-7c56-4835-a35a-9bd92b812bf0", "comment": "Malware payload", "value": "9d69e75beeed8469ccfd16406d1373bc2754e118193b68e059cf8d8787e9cce43fa4945afdfe039784a9d66af0b3b031", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786400021, "uuid": "c759397c-486e-4975-a8f3-18240a02da9d", "value": "T10ED33B13FB0C0563C8936DB81E3F07E983656D9210FED115260D7AAA1B33F71A687B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786400021, "uuid": "9375047a-8f2e-431d-97f3-6c2ec9696c65", "value": "1536:kDWz5jYd1EkPIDTppqzMJD6IwxmvjowjqG9eDx4SsubbmCqZxW5Qv8rTc4:kSz5jY0BDtp1ymrow+G2BbmzWQUTc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786400021, "uuid": "33a0a3c4-659d-4001-86bb-e26638b9713e", "value": 131984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786400021, "uuid": "9ffc60a5-4a87-4dd7-ae32-40b06f2b0a6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786400021, "uuid": "2601fe81-29b8-4a55-a255-c890147ab68d", "value": "1904d30ecdb622d1e657e56973578d062e4f109c4e9913a6f6fd47eed34283ad.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71865e2-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368279, "uuid": "7548f679-737d-4f59-a194-ce2713fdf948", "comment": "Malware payload (Vidar)", "value": "7337beff9e8343be14d7d4b45945c513", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368279, "uuid": "f322731b-cd49-4b1b-8436-34180acafa1c", "comment": "Malware payload (Vidar)", "value": "197fb13ceb2d68b830d514e9c5e425b6c6113a3866bf29dcd64b7cac5d8e49ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368279, "uuid": "f94f695a-a1d5-4b14-8831-d3685a37cacb", "comment": "Malware payload (Vidar)", "value": "83f2010e3b4dd20897a840d344ee08d534d6baa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368279, "uuid": "37957670-ca3e-491b-b268-e134332aa763", "comment": "Malware payload (Vidar)", "value": "29c272fdbe7494e8feb54c13a994df9410a9d8929a6250aa0bcb72027947241e4de3da10351f96d3dcec5e0cdaac4429", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368279, "uuid": "20519f67-309a-48ad-8ebf-6822e5031267", "value": "T1335209CB7193B178D16D873ADEAB66B7C727308513260ABF57ECC68026C3612747CA25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368279, "uuid": "36d4317d-8aff-4fde-9593-64fad0397760", "value": "05e6b80baad8cf4ab7984ab97f66f3dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368279, "uuid": "0174d2a7-e0a6-4603-9195-de47abfecf1a", "value": "384:O/frbs83MXiTwXsRjpxea3IayIwlBfDZ:0rI83CowKjpxezaBmlDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368279, "uuid": "0f6fa86c-4230-4d11-b6bb-2ac7ae7b5d9c", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368279, "uuid": "9430d646-0438-4b00-af9a-ef2bcb21ef15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368279, "uuid": "5062233f-1a80-4acd-ab5c-3b9899edc026", "value": "197fb13ceb2d68b830d514e9c5e425b6c6113a3866bf29dcd64b7cac5d8e49ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d611c3-9476-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786337028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786337028, "uuid": "16a5dcd5-100e-42c1-bde5-abcb4d1efdc0", "comment": "Malware payload", "value": "eb842f508ddc0bd5fce98846bdec224d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786337028, "uuid": "dc83f671-2a79-4a25-9851-3618a8414dbc", "comment": "Malware payload", "value": "19cb6e2c780df2cc64423ef5fd65dca77d3863eff4f2d8efd66c0f31d152764f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786337028, "uuid": "5133227b-7486-4c10-84ee-383eda6fb014", "comment": "Malware payload", "value": "7f0f2291030cebff26e66f2ce9864cb46d6a72b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786337028, "uuid": "d328c401-4078-418e-8662-0192739b7b34", "comment": "Malware payload", "value": "f4cd56b106250cb92b9bd6f56a06f3053494d2861cf02afcca224a65071878afa1adbe20e0b545c6275fef9bb006889a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786337028, "uuid": "01b366ef-48ba-4183-bda8-b39524c3d686", "value": "T12DC43AD4F2C55D7DF00619325FC3DB16E6126ED2E3685BAE892507492C8CBEBCF22168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786337028, "uuid": "22776e40-2099-49a4-acd2-8039b98b2c2c", "value": "6144:EJSkZt0J7wxSRRbZpAuneYMvzq0Sj7mgwQOsCOUyW7vt9q3/kTKVQp3q3DO:EAg43ZMLqpiQOVOnWb2XQp3q3DO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786337028, "uuid": "21a63ff4-2aab-4a61-b245-6b5c093f2dcf", "value": 562884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786337028, "uuid": "5ec02e8c-789a-4fbe-ba4f-0156728559b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786337028, "uuid": "b52f005f-60cf-42ad-8f66-5d6f1355caa1", "value": "main.nios2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6190fe92-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371089, "uuid": "54444650-bf48-44c7-a14f-09808ddc2978", "comment": "Malware payload (Vidar)", "value": "6f0e024d042531f68bbf554656f8855c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371089, "uuid": "e6ae5ec7-3f94-4edc-a402-85ca6f9abcbb", "comment": "Malware payload (Vidar)", "value": "19ee6a79f7851b673c91d7ac6853a76829b7c3d66f0a7af1b0a43aad88fdecee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371089, "uuid": "87b03e1b-dd71-4ac9-ab9c-d00dc2f15206", "comment": "Malware payload (Vidar)", "value": "2b38eac176cdc038e1f2e89e6ccd4625e65961b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371089, "uuid": "9ba85eeb-525c-4611-91ed-1658f53513b1", "comment": "Malware payload (Vidar)", "value": "10ce714f3e774380673abc58914e5f883ca48022a719d774f16d76d8dc77a380229ceafaefce7f1aa27931f928820920", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371089, "uuid": "d78c996b-8159-46cd-9d6a-73554c4a3484", "value": "T1D552D796B0D302F9D5B8C379D60A0567EA767093073B6BFF0BDC94603A852603A74364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371089, "uuid": "7caf489c-c1c3-4690-b2d2-8f797e5dc724", "value": "f49ef95be1e666482f052b8d214cb3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371089, "uuid": "e5cba987-b7ae-4ac5-a019-f4460237cf0c", "value": "192:gxnLxQgHg0B9IL6DIrNMTG+VAG2I1sXbpOO8wXVZ3VOWV:YvyL6crNMrGG2XXboO7XflOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371089, "uuid": "2c481de6-dffd-40fb-baf2-cd6cfe39b2f3", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371089, "uuid": "31a016a8-6963-404c-a816-b8da18027d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371089, "uuid": "b8630dfc-ae88-42fa-b5db-9fcf7d0df65f", "value": "19ee6a79f7851b673c91d7ac6853a76829b7c3d66f0a7af1b0a43aad88fdecee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2ad813-9485-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786343481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343481, "uuid": "234add55-fe6f-4697-b1cf-2c17feb28dc2", "comment": "Malware payload", "value": "3bb2f3b5aec84b755c5fb1d996fc28a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343481, "uuid": "32471f55-7c58-47a1-bdfc-8ab5056809df", "comment": "Malware payload", "value": "19ff2820e84060a73ce380673e13b75e65a087d74de2cd7d948be72c2ede0e57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343481, "uuid": "3134f2a3-e61a-4170-81dc-24c57dc0644e", "comment": "Malware payload", "value": "7aa2945acc01baddcec712edde277c1f1434786c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343481, "uuid": "c7d592ed-d4f5-4169-910f-299648673227", "comment": "Malware payload", "value": "e46e0ac33154635faff47584f26d4a0ae079f01d529f8f763b162d451d37f0f8cdfb41670a25c620b447f2cd051dd255", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343481, "uuid": "3d58f609-0acd-49ca-84e0-22da04e5c4a2", "value": "T1DF23E794F940DB25C7D074BAFA5E42DD33130FA8E2E631159E216B313BF79194A3BA12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343481, "uuid": "86a72404-41f1-4f17-9423-c6ab81082bb0", "value": "768:AdqOBWr03ntirEINhPhrXeXsLt3F7PNRsLTH5DOfhwqVqnFtbO+OAOnOx576qVJq:AdqKWr0ntCEINhPhrXeXsR3FTLETQ9qW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786343481, "uuid": "071f7d77-b78a-4fac-bdae-8ff52509a5de", "value": 45960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786343481, "uuid": "dde8b7b0-202b-4a2b-aaa5-ac075556c7f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343481, "uuid": "d0d6ae25-3c81-40c4-ae12-be9313cac6df", "value": "main.armv5-eabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7e2a5b-946c-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786332852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332852, "uuid": "836046e9-f3a1-40a3-94dd-c66a69091ed4", "comment": "Malware payload (CoinMiner)", "value": "0a77c05a1540d82470fa49ed3932b282", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332852, "uuid": "c63682e7-ff4a-417c-b939-9a2cd4742899", "comment": "Malware payload (CoinMiner)", "value": "1a1c8fcea547dfad3108c36f696da9548fb08c2b977d06288d04e1cfbe950b19", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332852, "uuid": "89dc5de7-250b-43d6-aab5-199d4f6351bd", "comment": "Malware payload (CoinMiner)", "value": "c191cc112ee0c4e332ab2a97378ed36a3975c076", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332852, "uuid": "779791f0-4799-4430-834a-71d35e0e9d05", "comment": "Malware payload (CoinMiner)", "value": "ac47fc3b42f7d5cfb536347e30fa8cccf323523c6e447a08e7e9a69f2045a8bdde7076629971abc8fa00ce4f7fc7016b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332852, "uuid": "8fe3950d-20db-4e62-b9a2-50186be0a09c", "value": "T1B8363315F8C2D4B1C41AD7B88613B0AEB37F77A9A9B47C1B33CC69104E65E2A647E341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332852, "uuid": "81e5cb6d-d4b5-4d55-951e-1b99866bde94", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332852, "uuid": "9c90c003-75c4-4e17-b55f-ada5c9afdd89", "value": "98304:9YlLtunCI0FyF8+cirXTH3CTt2mjr5wzvFHndc+vsM9pIkfPTb8DkTv+j+:8Lt28+c8THSB2nN7seb/8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786332852, "uuid": "a7621a2a-9731-458f-963b-b6cfa0082ae9", "value": 5287424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786332852, "uuid": "5fb7a51a-7630-4c5c-92a5-373a6b8a849d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332852, "uuid": "ae50228c-7d1a-4cca-9bbe-230844c2c2d8", "value": "1a1c8fcea547dfad3108c36f696da9548fb08c2b977d06288d04e1cfbe950b19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d79b84-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373114, "uuid": "090d8ae0-d75a-454c-bb7c-2d7232838539", "comment": "Malware payload", "value": "6fa81b7421184da4fff923482cc2b067", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373114, "uuid": "dd9fc69a-536a-458d-9149-009e72c1cbc7", "comment": "Malware payload", "value": "1a5661237d36a52d2310a32783ba23769c806bfec31524799ae16dac0f6c3b2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373114, "uuid": "69659182-4f9d-45dc-a1e4-c7d795df312f", "comment": "Malware payload", "value": "c4885bb743d5eace9c21d0b3b4eedef8dc3a476b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373114, "uuid": "e799006a-b20c-4629-b35d-d39abfba9866", "comment": "Malware payload", "value": "fd657fe07d31da19f12236ffd00e98ae14e18185029ae21ce13375ce60c766726f8f20f698e0c98f1c1316e3cc3b23f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373114, "uuid": "e787c152-9e6d-46f8-bcda-cbfc6da2106a", "value": "T103E57D07FCA118F6D0AAA3318A36A9527B21BC481B3123D76F50F6B82F72BD05D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373114, "uuid": "8fdc1aa0-b3c6-4031-aa61-837bbb78d0ad", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373114, "uuid": "9fe384f9-5125-440a-a3c5-f53c98b5a2ef", "value": "49152:Xf1Zj7Z2kU34kRTQa5agYVFTpJtYkMQwQuOchgOgnH4eQlY4ei:Xf/9s37TCPX4eQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373114, "uuid": "a1753492-75fa-4eb5-8f43-225bc9ed6f3d", "value": 3164672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373114, "uuid": "cc44fec4-7c72-49fb-a68a-d6c6d60729f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373114, "uuid": "566971f3-fc49-495e-926e-e2201c3fe338", "value": "1a5661237d36a52d2310a32783ba23769c806bfec31524799ae16dac0f6c3b2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c6383b-949d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786353815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353815, "uuid": "a04e3325-52f0-474c-8ccc-0105e50ce5e1", "comment": "Malware payload (Mirai)", "value": "aa8424e342f411d1c2341f42bb3724b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353815, "uuid": "1de1f05a-b54e-4ddb-a542-c989e14ccaed", "comment": "Malware payload (Mirai)", "value": "1aaf6b6ffe1846391f1157490ae916e2006bf2248df0fb1573c8c5c7ff5c013c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353815, "uuid": "efd90ce4-dbc8-4394-beb3-530daedcfdf5", "comment": "Malware payload (Mirai)", "value": "6d42b6c65bc737463714d42105ceec5118b23fb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353815, "uuid": "2f06c389-becb-4dae-9b95-db548fe0c5b8", "comment": "Malware payload (Mirai)", "value": "a67698c825ba8e0bb67a74650b9514eb3524d3e5aee55462558b161abddfe3ccf104fb87719bf265c902dfa9f6e37394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353815, "uuid": "0681a77f-07b1-428f-b2c1-78d1b6ac5774", "value": "T1B534C7067BA19EF7C89FDD3302E6860110CEF45722A56B6B7374D61CBA0A94F49D3C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353815, "uuid": "36323362-7284-4c77-bf6a-310ed938aa0d", "value": "6144:SXnBrFB10H6110xN/58WzvgreG3Ai/a9vNYzpWe:ErbIc1ORzvgreG3Ai/a9vNYzpWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353815, "uuid": "bab7654f-43ad-42e8-a090-da73367896e5", "value": 238414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353815, "uuid": "8012a5b7-4b6a-411e-a6d1-261ef8fba543", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353815, "uuid": "f2a5396d-9ab1-486d-bd11-912879c18287", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e86caa8-94b2-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786362869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362869, "uuid": "f0cc2c86-c6f6-49ca-bb01-a5637d7f8efc", "comment": "Malware payload (AgentTesla)", "value": "26fb1c9c1e679c743f2d493c0a889bbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362869, "uuid": "2478bda7-c0e6-409f-9870-e7b2c4fd0e55", "comment": "Malware payload (AgentTesla)", "value": "1b341c92a2bc3e9081b16d2b2521d3b6415fd6d717c066593a172daf2885cf7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362869, "uuid": "aeeffcb0-fdb4-4a7e-9cc3-995fe2345af4", "comment": "Malware payload (AgentTesla)", "value": "47c3720a608083c6916ddd393beaca77e302b183", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362869, "uuid": "5c3c0ea1-5201-4508-a357-6bd69fe7111c", "comment": "Malware payload (AgentTesla)", "value": "ce2ca5062bfc63e3bf8b73ab8a5b79e5f368971bb2826ea68c6d62a46780dd8c0d6ecc1df1539cf5ba5eeb141f2de302", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362869, "uuid": "e339ea7f-632a-44b0-af6e-f53719d1a2dd", "value": "T17CE53CA056087BB0AA3D672ED4276F080F2EF10BD254FE1F367C564477A675B22CD8A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362869, "uuid": "79ff014c-5137-4521-982b-ee6ae6cc82c2", "value": "49152:MGURS3nAph9sNeSQxwowW9MbacWX6+TXZBf97xdaB0KbnXxYgE/nBGNh62crh7:MGURS3n4h9pJw6MqZBf97xdaCKzXxYgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786362869, "uuid": "1d19cdea-b175-4ef1-bf42-e73309451bf6", "value": 3041778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786362869, "uuid": "796b543a-6868-47e0-a89d-77ca0009a9eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362869, "uuid": "7fbb12b2-fd11-468b-910b-70c25a283c74", "value": "Quotation.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b0ac15-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369487, "uuid": "19bac9b9-5262-490e-a255-894e29cff339", "comment": "Malware payload", "value": "22d1b589a4daf4d6723d1a10e7db5e5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369487, "uuid": "ea916151-83a7-4894-8c67-09d4ad4cbe98", "comment": "Malware payload", "value": "1ba36565e2e25ab56db7eb706f8797667dab1cd6c0983a889c626dd00467a555", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369487, "uuid": "8f295b53-1cb2-4c42-9365-a16ed1438bfc", "comment": "Malware payload", "value": "68f7dcd871ad09944f62c392bc24821ba7933dd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369487, "uuid": "8217ca7a-a5da-41a2-8b86-f5487aa84232", "comment": "Malware payload", "value": "269b18d568456643faff4a3590ad45ce258cc4d68a1eeedfd7782c1a4a7e4862999e86be86430ef34d0dc0e87dbf6651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369487, "uuid": "e2481840-8db9-49e7-bc4e-506c107791c8", "value": "T1A545DFE06F419554D87F0B78803658A777B2E60E9EA8C60E3ED9BE5B7E73341841384B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369487, "uuid": "7636e260-d380-410e-a7eb-dc1ec6f1e9af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369487, "uuid": "dad99601-1ebc-4d21-bd9a-19ba1de3ad24", "value": "24576:z9+9qqigNf0NSIXtbJXsFxWbyIfE4uW/nz1K/kNQbA:paqP200IpJXixWbyIiW/82QbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369487, "uuid": "ba17f96a-0c30-4488-b7d5-6945b3fab2ca", "value": 1216000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369487, "uuid": "555c7e8d-7694-4971-a7db-109352fe948d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369487, "uuid": "c205611f-2a11-4ec3-a717-d4a1f214737f", "value": "1ba36565e2e25ab56db7eb706f8797667dab1cd6c0983a889c626dd00467a555", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a9a9d0-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786372681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372681, "uuid": "d2611076-8bf8-44ec-be52-5a2798fc6874", "comment": "Malware payload (RemcosRAT)", "value": "95e1530f164b5a9a911ee3ba2834b132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372681, "uuid": "dbd76684-1755-4890-b21c-bc43d009eca9", "comment": "Malware payload (RemcosRAT)", "value": "1bd4cb378ee5a101189665072f5d4999d76d336c2887c217e6be6cc0a924c84d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372681, "uuid": "9b782ce1-28a7-42ca-8bba-6453865fdd95", "comment": "Malware payload (RemcosRAT)", "value": "e6b0191a4f933f5f500427adae2900a8765d8eef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372681, "uuid": "0b6397c9-3d34-4d6f-ab51-ab5bd1b62ca6", "comment": "Malware payload (RemcosRAT)", "value": "ea992941b5d347ce3b1bb8b0f1fc55c65acaec659c561e0ab16094555dc6c62fd3daf99fc78a3ba07aecb3b0fd5b93a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372681, "uuid": "3f73a613-add7-4e76-8f8a-ba74923cef0f", "value": "T11315F1552317D842E0D59BBAF9E0D37433609ECEB9D3C39A5EE92FB7392A3C15980181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372681, "uuid": "102d816a-3541-42bc-8b50-84409f08aa54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372681, "uuid": "14bff2a2-b63c-474a-b3ef-8773b0cb4479", "value": "24576:WHp50jAmPLRgXxSKxiE8KPjYS3KxsHH/x+I7o:wpiAmDRkxtcZKbYS3KxsHfxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372681, "uuid": "5934ed94-2a0d-40b2-9967-07f92627a430", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372681, "uuid": "c13fefa2-d498-4603-819a-64ea9383ca1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372681, "uuid": "b34d6053-e07a-4130-8fdd-b7ee717593f5", "value": "1bd4cb378ee5a101189665072f5d4999d76d336c2887c217e6be6cc0a924c84d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbfdbcb-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369203, "uuid": "efe3c3cc-0868-4e43-bd11-d06f2b2dce13", "comment": "Malware payload (Formbook)", "value": "3a2dc6669b64c994a8872eaa41658aa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369203, "uuid": "8eeaaf46-4007-4449-a731-f9489f021383", "comment": "Malware payload (Formbook)", "value": "1c3b5acda06dccd8c35aba56132af62daa376e01daf7d3c1a34e6c04284139f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369203, "uuid": "64a988eb-7250-4a6e-a546-652c155ff641", "comment": "Malware payload (Formbook)", "value": "3278b18cb938e386ce4bca738f9bd012d8998c79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369203, "uuid": "8d5b9608-e030-43bb-a232-e589d4e0e3c9", "comment": "Malware payload (Formbook)", "value": "e1ede9679c9056e6719f9ca4f2c5151ccdc4d274f54b9249922b63594eacd989f5d1f53874ea17b0f718778a8dbdbb63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369203, "uuid": "93c9ec87-bebc-43b6-af31-ead4fa3fe787", "value": "T1FD350208176ED806D4930FB19A71D3F816B69E68E822C3439EFEBCE7757AB467404790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369203, "uuid": "12617b34-a5df-4ba8-a8d9-250e4ad6a46b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369203, "uuid": "7279bcd3-fa5a-45a6-98b5-49e846bea7be", "value": "24576:rZkYeJaOEzcb/u9HJZ2WbfuEDm4RhtVeiHqEPvU6skB:rZgpEzcb/kpZ2QWEy4RrVe8TPvGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369203, "uuid": "56a6006b-495e-44ff-837c-02a0a2195c28", "value": 1098752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369203, "uuid": "6644a02a-7fbf-41fd-b8bf-159f97dd38ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369203, "uuid": "2352fe16-db65-43bb-8861-fb70fff8788a", "value": "1c3b5acda06dccd8c35aba56132af62daa376e01daf7d3c1a34e6c04284139f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25399c28-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340064, "uuid": "0cb37e7a-b880-4362-a545-1b1b7df43dfc", "comment": "Malware payload (Mirai)", "value": "0a80cef93a3421685f26fbeffefbfcdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340064, "uuid": "90cfa1c5-26ca-4ad0-a509-0e5ee36365c6", "comment": "Malware payload (Mirai)", "value": "1cd0ec8c67c386bb7358233aea9fb91daf4a71ada0ccd21d52ef4d828244ddb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340064, "uuid": "e42c60df-ce25-4974-b93e-8612e11bfbaf", "comment": "Malware payload (Mirai)", "value": "aca0745f70553e619cf0875e160d4e9caaa0dae3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340064, "uuid": "30c148e6-7a90-4ad8-bd30-5173e1d3af01", "comment": "Malware payload (Mirai)", "value": "f310c7fff87ebf747040e7e46e9cc22255a5ac4c175a4096ac795b400a214641328354b62c03c9aa5dc76de837af22f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340064, "uuid": "e1826e36-52e0-4c4c-b7dd-ed5c12cd4874", "value": "T1F8842C48A1F1E3EDE164E570531DBE169C7146333093728AF39EB97363A71804AEDA39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340064, "uuid": "c906a60a-dda1-45f7-84d7-4afd84374a09", "value": "6144:lqeba933pJzdgqSnoBuVDeQblIki0HJIg+1tB/drGuGM99:lqeba933pE/nyu/blIki0HF+PBUxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340064, "uuid": "f7292409-4ac5-4f66-95a8-884d1cef293d", "value": 380292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340064, "uuid": "f4bf90fd-4657-4e02-8802-15c4de7b7aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340064, "uuid": "69ccb6d9-dfd2-4f63-996d-b1f539de9a9c", "value": "vlxx.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eade1c0b-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1786373896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373896, "uuid": "b723281c-4e97-4d02-b834-cdd35cecd5bf", "comment": "Malware payload (SnakeKeylogger)", "value": "06100be196a549d76eea4e5bf1df106e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373896, "uuid": "b9cce1a4-eae1-4e9e-aa32-6e8603c69490", "comment": "Malware payload (SnakeKeylogger)", "value": "1ce77218079adad6c0a97c6bc72508e97c1d22cc35047e70bd52d5ef9c134601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373896, "uuid": "1f29b132-8e51-4291-9e14-7236d8aa0951", "comment": "Malware payload (SnakeKeylogger)", "value": "3d190c025bfa59d15a16060bbc680defd2bd747b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373896, "uuid": "d148c74f-1916-4650-bbf7-dbd6f165c5fd", "comment": "Malware payload (SnakeKeylogger)", "value": "a1b88a11641bc819fc674bcc49a158e9b5a2a4214289d768551508d8c5e33530983028ff8be70fc46609593a8e3af4d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373896, "uuid": "6d5d6bc3-d855-4f34-b34d-982a43b48fc9", "value": "T1D425231E97A69716F46A4FF54628E63113F6DC8EA330E30A9FC82DEB79537244A05343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373896, "uuid": "e1998bb5-23eb-42a3-9ca6-0732960bba72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373896, "uuid": "fb5bebdf-7022-4a9e-9939-cf343f74a14f", "value": "24576:wFVssr77K61LrU/qoEYGo53cIULJabbsNT948JNT0XOyTK1P+:wFZ7BUFz5sJFEbi948EpTGP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373896, "uuid": "0b03f359-93dc-4e29-8c9f-1f87ebf453db", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373896, "uuid": "d3a6be39-8d6e-4bdd-ae8e-c85b6d9450f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373896, "uuid": "116cbd59-0a02-48fc-856b-b626181a82b7", "value": "1ce77218079adad6c0a97c6bc72508e97c1d22cc35047e70bd52d5ef9c134601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cad9995-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786355592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355592, "uuid": "ead4816e-0c15-4766-a879-a6aa1f8c31a5", "comment": "Malware payload (Vidar)", "value": "48d66a8f0f2a7d144cfa1f6b7a006c69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355592, "uuid": "16e74cd5-a65f-4588-9dda-07d12b33c830", "comment": "Malware payload (Vidar)", "value": "1d60903c4cf77503ae2ccbc0e1f33e455033bca93d1a289531df7e1a166a5449", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355592, "uuid": "3ed6b918-bfea-4b77-a38d-0763e4beb766", "comment": "Malware payload (Vidar)", "value": "b267d67a00e870fe7f6b2b595842231ddace2657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355592, "uuid": "d1261290-2556-4ce7-9614-7e72c72cc6a9", "comment": "Malware payload (Vidar)", "value": "12db7df9a35c90b1937abbfa7aa63b4a205848629aa62d0cea6d0b7b07b3321289da25f5cf94ffcf3bd98057304ab656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355592, "uuid": "fc0ff38a-2eed-488d-961a-12df21fbb727", "value": "T1D7068C03ACA189F6C099B73188B79252BB71B8085B3527D72E61BFB82F723D05D36754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355592, "uuid": "df80a13e-bb44-4c24-bee2-9ec8dcbdfe24", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355592, "uuid": "134f6329-1d27-4b50-8e4e-18e0deb5dedc", "value": "49152:PzAYhHUjjTzdu7fjboLmZuJ+OTjtI5nSBPfC01/xPdJuL1Yz3M:Pz3bjjboLmZuJ6pP6aqz3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355592, "uuid": "6f4e5c25-1d43-4bdf-9fb8-7be86c657ec7", "value": 3987824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355592, "uuid": "cb1b8337-ca3a-48e5-b361-966d9d8e6c72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355592, "uuid": "81ea764f-3201-4684-95fe-a87dfb842139", "value": "48d66a8f0f2a7d144cfa1f6b7a006c69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20dc74f-94ec-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786387974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387974, "uuid": "3ddf9f52-8afa-4242-9cbf-add0a57e48b9", "comment": "Malware payload", "value": "ac3ce3e97631785fb13893a2a9d600a4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387974, "uuid": "a7faead6-d74b-4bd9-962c-ed836031872f", "comment": "Malware payload", "value": "1d7be0eb2f6771b7a71b9eae3054eaa7a30467b68503c68ce29b50629e0b90c9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387974, "uuid": "16c0adab-80ab-4a0f-83c0-7b768c18d6a0", "comment": "Malware payload", "value": "4aeba1ed14946362724775399ea2a68a19b57efe", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387974, "uuid": "f9fce342-4f2c-4103-84df-41ccc2818ecc", "comment": "Malware payload", "value": "7f85384ef19af32fa94c2a9baf9c88ec3c886d0c8f576072f95556ced5dea760c8d43278cfb4d132375399e76a9d7295", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387974, "uuid": "5d1e55d6-2054-406f-bb43-a01a6915488a", "value": "T190266B03BE9148FAC0A5E73589B74252BA75BC4C4B3133D72E60AAB42F763D16E34B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387974, "uuid": "3c65214e-91f9-41ec-abb8-eb4847e1e1c7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387974, "uuid": "b66a4ee4-613b-4c92-8fee-6e6de2883756", "value": "49152:Ec7NgkdiWps0rzLXpk2MP5/3C4jmTD+s+YeGn8yJXCapAFKj:EyppkztfsgU8ytpXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786387974, "uuid": "690e0c78-c75a-45e8-ac38-fb4ef330ff10", "value": 4820848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786387974, "uuid": "7df2bb79-d24d-4d64-85b7-a05af12872fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387974, "uuid": "cdcfafdf-d266-4dbc-b42f-15d8949dc06b", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe7b2fa-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371220, "uuid": "656ecb46-7e05-45e0-b50a-51c7c3cb31f1", "comment": "Malware payload (Vidar)", "value": "0f17b8e4fbb02459aaa5297a1881eafe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371220, "uuid": "325939e6-9fa9-42b6-be98-0e0a36ac7e0c", "comment": "Malware payload (Vidar)", "value": "1dd7ee0dadf5fef422678d9b00e4b78684c314c8d4effee2034a7724de095ebd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371220, "uuid": "3a1c2622-2d1a-49c1-bdb4-ae00528d56ae", "comment": "Malware payload (Vidar)", "value": "f77ed7c67a08a35eae8136f5fb955dfd45687df7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371220, "uuid": "5ecb270d-ab22-46fd-b963-511e8e92a1fc", "comment": "Malware payload (Vidar)", "value": "590aac8679aa3de639fe1597ebcca07c434584020e0c005a2ec470ff9571898c6d617bb8400f79a3f1971ababf4e8f30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371220, "uuid": "0305b8cc-ab8c-4683-9282-069679f7c5cc", "value": "T1CF422983F1C5E4FCC1EDC37A8C2F16B69A1634885761A9BF76AD54542BC30A271BDE80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371220, "uuid": "2a7dfe86-f165-44ac-a35a-195e1e7ddedf", "value": "b5dedaa92e3b299ba2882a40f166187c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371220, "uuid": "d9d66c26-9121-4b14-bc01-8415b8f37a51", "value": "192:O/I0gs4/wx5yk/9udxDFkXJiLVu5Y6ftpY13VjY:O/3gMxseudlOX4LVuLFcljY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371220, "uuid": "55f554e2-a49c-4c59-9f73-f5ff4dedd415", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371220, "uuid": "9bc602f3-a848-4c19-83b5-116d387bab93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371220, "uuid": "018f901c-dda3-47fb-80ab-b327347f5be8", "value": "1dd7ee0dadf5fef422678d9b00e4b78684c314c8d4effee2034a7724de095ebd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d55603a4-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372142, "uuid": "5dc9af6e-6476-4605-9add-690ed0e2a442", "comment": "Malware payload (Formbook)", "value": "68434f9fd0d693ddcd31e7d978e1104e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372142, "uuid": "e26ea616-4400-48cc-8f30-9aabac86fc40", "comment": "Malware payload (Formbook)", "value": "1ddf551103612b97461daaa7f829bc13d87a8a817165b96f0bbfd8c8938c10fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372142, "uuid": "006aa962-a9d6-49a0-8cd8-53bcc197fed2", "comment": "Malware payload (Formbook)", "value": "241b49d8c361d43e9b4e6f9417ca63c79d21798f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372142, "uuid": "60d6cf75-3816-454e-9d9f-d0c53349d028", "comment": "Malware payload (Formbook)", "value": "e8d3dec69f30694199cd3ffa30f4e1ed63ad37e6f9a54665be5fc84e60c3030bd5796f1948ce5186b5a85b67eb83673e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372142, "uuid": "bd73814f-5323-4bfa-bbcc-2e2e89a4e9b4", "value": "T17125129497A4CF06E6E607F48961C2F403B81D9ED011E723CEE2BDEBB937791A454392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372142, "uuid": "0669f934-5df8-44c6-8113-37ceff9f413b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372142, "uuid": "9c852d73-0df2-413b-b40b-c5267035daf6", "value": "24576:pj/Og3tTo7o9aXhW3EbixNcycj6EVE4vzfhsLrN/xQuKsH:RPdEMVx0j6UrvzGN2J6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372142, "uuid": "ec6b7122-3c08-4e4a-bd58-5159d82c3f87", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372142, "uuid": "ca0ee84f-0abb-47b2-9688-aa6c54a488ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372142, "uuid": "742584c1-c3d3-4477-98e3-6cf1290ab73b", "value": "1ddf551103612b97461daaa7f829bc13d87a8a817165b96f0bbfd8c8938c10fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00e26cb-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371677, "uuid": "f61394f1-664b-49a1-a2d4-47f666ddc0cb", "comment": "Malware payload (AgentTesla)", "value": "ca940b5df9b59cb0e0dc0a36db4485a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371677, "uuid": "9018a7d7-0f9e-4ac8-8b23-a33bb9e3d96f", "comment": "Malware payload (AgentTesla)", "value": "1e2c86adb2a9f3853671bb85a3ac34d7e0c83861a9a735349c396986a15d99ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371677, "uuid": "ef8ae667-b11a-4610-9643-6f2d0189b266", "comment": "Malware payload (AgentTesla)", "value": "98e3218ed89a9f8f750c1935915c0f315ebc0910", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371677, "uuid": "a6b73b74-2dcb-4827-b331-1e0fc825db1a", "comment": "Malware payload (AgentTesla)", "value": "b43f2ecf817f0e5ac6933277e7cf9d36a023dde1b26ab6f03257895ef3f8241ecf79f004be0be43fc0f74f26d20a9b4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371677, "uuid": "7cb222c3-7214-434c-847e-47c74346bd4e", "value": "T13B45E136EE866295EE3D0778C427441823B0CD23D263DB2E3DE9F0F54B73254AA5B199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371677, "uuid": "4c11bcb8-f21e-4ed2-b5ce-415904a5c1ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371677, "uuid": "49e49695-0257-4792-a885-8adcf45b2420", "value": "24576:L2UxAPqGcv/+Duyx4KPMX+e4PXtvEj18pNh:jqPRcvEkWPX2j18nh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371677, "uuid": "346eafd2-0250-4556-b44d-26abf73e47b9", "value": 1238016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371677, "uuid": "7f5dd402-ccb5-4196-be7e-3fd89ca66e56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371677, "uuid": "c10ce2b8-dd43-4bdd-be44-7dabe5aaa310", "value": "1e2c86adb2a9f3853671bb85a3ac34d7e0c83861a9a735349c396986a15d99ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32898be-950f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786403008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786403008, "uuid": "9354e04b-7347-44a7-a4ca-633426dbd19f", "comment": "Malware payload", "value": "224b41af1717915304b30540473b8db2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786403008, "uuid": "eea55cc2-778b-4aef-93d3-13f853a38930", "comment": "Malware payload", "value": "1e70b63472772e3f5092ffe9c3573470e73590e6ab6d93fdcede1d368a5fd72d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786403008, "uuid": "8651ee3d-7ad4-468f-b113-7fdc91c373cd", "comment": "Malware payload", "value": "90d8371f9dcf69d9823549efb2de0cec384b7d98", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786403008, "uuid": "f96845c1-e6d2-4eda-bc8d-7f8b68ab041a", "comment": "Malware payload", "value": "ddbb6e5ec939c78f9d87cd25fb1ee8d2e4c7a74e891a144b7d27970133da364c8505ba5a04aa84f9df6dc2ca23824137", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786403008, "uuid": "f3dbb451-7625-4815-883a-736fa59d7ca1", "value": "T19D41126E74618E7033BDC8BC3885254C6797A66B48262F75B047783D27FC374B2683A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786403008, "uuid": "c04dc67c-fd24-429f-8f89-0560c843e497", "value": "48:vkwvpihneZZn1oB1nDL2Y21j/EmfthmmDoht6GUskURMTCSgMul:vkwYheZZKLTujnFhmmn1o64d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786403008, "uuid": "7b9deb2c-29de-4467-aeba-b7c271e11a1d", "value": 2126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786403008, "uuid": "dc762386-9c72-476e-b0c5-44eec50213bb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786403008, "uuid": "ca934a77-ced3-4c98-9181-6ac322f61296", "value": "1e70b63472772e3f5092ffe9c3573470e73590e6ab6d93fdcede1d368a5fd72d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e947b88-94e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1786385713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385713, "uuid": "4b14950f-26c4-4fdd-9f13-021b60551162", "comment": "Malware payload (WannaCry)", "value": "96e92d4e66e223a6adf571473d23ff55", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385713, "uuid": "31ab33bc-2702-4e49-9067-1fb67114242a", "comment": "Malware payload (WannaCry)", "value": "1e78e60de13290234f642709674835e7b400102d7d22367266fd38329782e58e", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385713, "uuid": "e711f2d6-cf3e-46e0-b197-4c5c0a96a5bc", "comment": "Malware payload (WannaCry)", "value": "d52701a4ac5a141a3106efdc2b6b61a15167fee8", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385713, "uuid": "a1079fee-b08a-404a-ba03-ec4359d80448", "comment": "Malware payload (WannaCry)", "value": "2eaa9c750bb45ca9b99f2b457f016024379b9b08c256af4e495983aecee61de884c615c07d3ec194bec29ba620166cbf", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385713, "uuid": "8cdb6bcd-b01e-4421-8b51-87e1032233b4", "value": "T15936238D32BC81FCD00619B484B78E16F3B37C5A12FE5A0F5B548A7A1E53B55BB60B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385713, "uuid": "217f836a-b218-48eb-b898-db87a19b902a", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385713, "uuid": "9976c88c-3683-446e-8b46-2a865800c33b", "value": "49152:jnsnsQqMkVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DM/qXhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786385713, "uuid": "2d9eba41-f735-48f2-98f9-86d8bacf0c63", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786385713, "uuid": "d5e6d012-7fbc-425d-9d58-edcc2ceeb45b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385713, "uuid": "26766a9f-291a-4c8d-9dfe-ac9465faadef", "value": "1e78e60de13290234f642709674835e7b400102d7d22367266fd38329782e58e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9b63c7-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368582, "uuid": "3e08bcad-d6b8-427a-b6ad-167cb1fdac8e", "comment": "Malware payload", "value": "2becabfcc3249d04de7ad86696a08050", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368582, "uuid": "8318fd9c-e01d-4dd0-b773-618745777724", "comment": "Malware payload", "value": "1eaf8ab730af5153c707239172f9c0deb417f929f9b596dcd2958d0e88043da3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368582, "uuid": "47fae98f-7d01-457b-92b4-4f84b6a488e7", "comment": "Malware payload", "value": "5501fbe8f35b1c4d5045c6bfd70cab17d9763762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368582, "uuid": "c09d7390-9716-4d0a-ae4f-6347b1b86c7c", "comment": "Malware payload", "value": "869fc86a34796d9dff1a0d0b247602e4c1c9e02659cc6f44ad2617d2c30ab1d804d6fe1413b7c1203b8fba532974a983", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368582, "uuid": "830587a9-d7e6-4a5e-83a3-38db37ffdbac", "value": "T1E2945B9477E54A06E2FF5FB4A4B20A5047B2F853AA27D74F09C590AC0E32795CE14FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368582, "uuid": "4f114f82-9550-4633-b419-5240c94e9471", "value": "6144:NMET8qCsVK7wOfhnjY89S8vjOrV15t5Gw5Gg/rcN6kgCmpXza9bIdbcD8zyc6uTu:qETPzt6hjYkS8un/5N4sCmpXxSBC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368582, "uuid": "23f909fb-8944-4ca1-a90a-d0ad9919456d", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368582, "uuid": "38259039-446c-4a76-8b48-8817aeafd3de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368582, "uuid": "d027508f-5a33-4a8d-a3c5-3678d5ee0dae", "value": "1eaf8ab730af5153c707239172f9c0deb417f929f9b596dcd2958d0e88043da3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea0fa8a-9466-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786330550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330550, "uuid": "75016ba9-fa88-46c0-a47f-38e4de7361bd", "comment": "Malware payload", "value": "f331adc29d2ff9e615955f2bf9485d23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330550, "uuid": "8129304f-29e5-4eae-9b5a-986830383ad8", "comment": "Malware payload", "value": "1eb0ee613f578746dde06048527eca9e397cd3569eec2e7800434af51a0258eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330550, "uuid": "7b81b2ae-4564-43b6-9aaf-eb0f8a4e3d49", "comment": "Malware payload", "value": "a56ffcddc6cccbccfe3d0e728e801b9f9c218fde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330550, "uuid": "aa0f5316-bcde-4b95-b3e0-ea38e2ba3fe4", "comment": "Malware payload", "value": "7feeb595cb084a2f34c0e7c9901caa59e131860207f647f1ef0ada00e932384127720d79b0c558b8d9d34f72aeb29cd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330550, "uuid": "048974a0-0108-437c-9e0d-847115b69159", "value": "T19E63E907EA916AF7C41ECE70452DC24A11DA5CFE92E9511F71F8C98CBBBD3194AD3888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330550, "uuid": "758294ba-fe57-4c2e-9df2-acd60439c0d9", "value": "768:6TiD5KnFvsxi3u8G7/iVI8L/EHaul+lSNj13JKnZjNnPYklu86aR48HGS:+iQnixp8uZ8wHaul+lSN5snZRrT6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786330550, "uuid": "37ff97d0-ea5e-4454-ae54-8b3141c73c5f", "value": 72960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786330550, "uuid": "748ae839-d27d-4821-b2df-fb54e4d1264e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330550, "uuid": "e3b3a681-4fef-4ddd-8e75-f84df4c95a82", "value": "main.mips32r5el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73e74a3-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371716, "uuid": "06df01d1-4aec-4ed5-a953-9f78b814e370", "comment": "Malware payload (Formbook)", "value": "ff86edfefe06e801bae2febedbdd9dab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371716, "uuid": "f5c8c861-42e8-4a75-816d-1413e18b4a8f", "comment": "Malware payload (Formbook)", "value": "1ec67d002e59295ad714a05036165a091cfe97e5a7a3498186bdcc80df8e8038", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371716, "uuid": "838f0c8a-9929-413d-958b-65d9e9b9a806", "comment": "Malware payload (Formbook)", "value": "94031fab82132fd26d61b8c49060a3b3f67d73ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371716, "uuid": "2df15db4-b8c1-43ac-9d02-a4b70efd65ef", "comment": "Malware payload (Formbook)", "value": "c486579eb998606190384d231b463661ae40148ae93d3b1874301a1354747861f5c547bcb87aa7bc18520b1fd31b8e00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371716, "uuid": "5a0c0919-1fe5-46cf-8292-aa067d053303", "value": "T1752523A96619E61AC81153364F70F2B8277D5EEAB910D2169FE87CCF7E33F01AD40192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371716, "uuid": "9f8c5342-f4ce-4192-a0e4-7a91ef0a53da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371716, "uuid": "01807de4-e729-41ac-ace6-5b20aca83fdf", "value": "24576:3eB6p71YlmxarQs7oAqvEvK5fmboQtISZfl74dRX1PJ:fh1qmxls7mvE27QT74dRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371716, "uuid": "77139abe-ed3d-4859-8351-604e05d4e782", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371716, "uuid": "92d2bd09-0957-4c3d-a5ee-63264b4f004e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371716, "uuid": "ecbb6b2b-35ed-4e59-9f90-693a424d8009", "value": "1ec67d002e59295ad714a05036165a091cfe97e5a7a3498186bdcc80df8e8038", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9502cc00-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370745, "uuid": "22c1dd17-b521-4725-b545-eba0b0a3263d", "comment": "Malware payload (Formbook)", "value": "3ec946c87a5bd89ad8b744a2dc9771a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370745, "uuid": "598999f7-9540-45b6-8b5a-79c911b0cb92", "comment": "Malware payload (Formbook)", "value": "1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370745, "uuid": "5aa28e5d-8950-4044-87d8-1c269f524710", "comment": "Malware payload (Formbook)", "value": "235f368abd1a8396a14ddd6bb7e491fcc91211b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370745, "uuid": "a4210146-7e99-488c-97e5-d0856225de8e", "comment": "Malware payload (Formbook)", "value": "1d9b33bf3ecbe8c10fbba45900b91028fb3c479185fb1e9585cf0233d1f685d225ea27754fc45b6bf9300d51c6a99ce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370745, "uuid": "7a36c5d4-637a-4301-b55b-76df907c4565", "value": "T156251298DE09CA12D9925BF46861F33E52715CCEDA04C3A7C9FD9EDF3C19B096C24982", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370745, "uuid": "24dc5bd4-01b8-43c4-8b55-48b98b7b300b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370745, "uuid": "c1413db9-e8b6-4e17-aa01-7eb3bf14c918", "value": "24576:wJhdQAIYd24wqb4rve+Txeua059NFZ/dQ1lfL:wJhdFlLwqbGe+TIun9h0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370745, "uuid": "1074808e-f60e-487d-81d8-8f3ea8820172", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370745, "uuid": "02d4017d-0443-45e2-b150-c81b7148cf5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370745, "uuid": "628c2298-aab6-4d52-a54b-de480661cce6", "value": "1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c3621a-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786370685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370685, "uuid": "e82cb33f-1a45-4092-8ce2-37f20f2914dc", "comment": "Malware payload (GuLoader)", "value": "a16767a43943bc4c2e25d69ca4ca68b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370685, "uuid": "03deebe3-3d79-483e-9208-0d255d9e3f42", "comment": "Malware payload (GuLoader)", "value": "1f699db45e66e2a2d404231be31e51d3a6d390a73beaeac4401de6866397dc4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370685, "uuid": "ce7057cd-25a8-4937-b27d-de24d60f2888", "comment": "Malware payload (GuLoader)", "value": "bed104a086f69d9fd7b69f6b7f1797b18a26c862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370685, "uuid": "b9b7c727-236c-4ca4-bc54-4975fcae2f56", "comment": "Malware payload (GuLoader)", "value": "ac899c3042a99d852c586ee2e127163990e9ae2dcde47d8c8318825e6008f4ea71b8c8b425b7a57f7fe392c12a6d6873", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370685, "uuid": "0d5556b5-514b-4da1-aca9-aded38904930", "value": "T1DB94CF83FA80D6AAFC3D4875D9A352700B72AEB596854F4353D879123FB22C0753B52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370685, "uuid": "444a05e3-c5ee-45f9-896e-48af4a9198df", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370685, "uuid": "38c3b600-09e5-43d2-8c3d-0c0dd8c01c6d", "value": "6144:omGIhCrl0WKxHId8CWoWZGipPIR3oRsu22KqEWriKUofF9a5q56zX:Pm0NxodvEYuu3o82KoriKUC8qE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370685, "uuid": "f9d29bdd-81b4-4a60-abca-d46682edb238", "value": 412744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370685, "uuid": "1471baef-9cee-43c9-85d7-1adf11d5ef93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370685, "uuid": "3d12fe0f-bb8f-4320-b543-ebd0dd22ecd0", "value": "1f699db45e66e2a2d404231be31e51d3a6d390a73beaeac4401de6866397dc4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0750934-948b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786346364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346364, "uuid": "4ae80fba-84f2-4448-bde5-513111759ede", "comment": "Malware payload (Mirai)", "value": "e57f1fb416c86f6c1f90769d36df28fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346364, "uuid": "d688325c-cea4-44bc-9596-1b0979fa813f", "comment": "Malware payload (Mirai)", "value": "20152d401c779e8f47a6d9a5fb379a14d45965a2ebb9df3d8535a9ff48f02173", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346364, "uuid": "89ce0809-3d9e-456a-bf49-153cd8cc26ff", "comment": "Malware payload (Mirai)", "value": "f72ec98c5648f6232e51c885368928d707027270", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346364, "uuid": "347a9ac5-948b-41ff-b42f-db0d47443adf", "comment": "Malware payload (Mirai)", "value": "d1413a18e2db4715fbb4ed81b9f6cd993c8a3ffc413d35a436d21a401a69b0bef3749c035c83e151c233a9d199115c85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346364, "uuid": "c71df76e-0264-485b-85df-ba6bab54b043", "value": "T100941A4463B0D7DED1AAEE70223A3F1A9FA60A2730977546211FFA2303B217149D9DF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346364, "uuid": "20a532b0-4359-451e-a431-1a040d20f654", "value": "6144:/S1zDjpM5wpRIBvSeL/uYUrwU8aQlvuDk9mo26iQ:/S9jpM5fB6eLdU0USvu4l26iQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346364, "uuid": "f49772e8-85d3-4ef3-9cad-7c2adf11641a", "value": 410384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346364, "uuid": "3c691e80-36ff-47bc-9183-2d5193f16c4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346364, "uuid": "c393ccb1-d699-46fd-bda8-35b4fa805e08", "value": "skid.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb1611a-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383588, "uuid": "8733cf56-73f3-4fd6-a2f6-1370c6901139", "comment": "Malware payload (Mirai)", "value": "8966b031553ba7d8c6d22e804a2e6798", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383588, "uuid": "61b5fb8e-4af9-447a-9e53-88af078bfec3", "comment": "Malware payload (Mirai)", "value": "20a39dbab341d848280bb34b1bfbb40da0837b918ab3ee7b2dc77a9ac28b0c71", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383588, "uuid": "cfea4423-13e2-417d-bb09-2aa95dcea865", "comment": "Malware payload (Mirai)", "value": "455ffbe9e2e79df9da55c7f7500dea96d516405f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383588, "uuid": "701f397a-e0d8-4c5b-8aaa-fecbb8c0184e", "comment": "Malware payload (Mirai)", "value": "11cd3305c24651da851c2049b0f93d577ef28b90476c292a61817c38fb05e54bcca69d21101d57c4e8d56878fcf19964", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383588, "uuid": "1101a345-84dc-49f7-87d5-f2e0f892be1c", "value": "T1EA042996F880DE62C6D027BABA9D42CC33131778D3D97106CD246F3977EB95A0B3A941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383588, "uuid": "fceef6b1-325a-40eb-8d2c-78739d1fddcd", "value": "3072:eG1PvMN02dv99WVuuu5JNBWRRUeEvIZwOKD14WgWYinrYTtaJ:eiMN02EVuF5JNBW/KIZwOKD1q2MxaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383588, "uuid": "2cccb987-1287-4d9e-ba71-9c81bfec5257", "value": 177724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383588, "uuid": "bc987406-af29-4905-b1f2-6da38bae756a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383588, "uuid": "19505296-a4c1-4d0b-b549-39ca2d98133d", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e0fb22-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370957, "uuid": "291c70e8-ecc5-4e32-9601-d1eb4bb61d9b", "comment": "Malware payload (Formbook)", "value": "12c19c2d6adc24c952532a015c826e25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370957, "uuid": "c349274c-58d1-4b41-ba3c-da0e2c4ccba8", "comment": "Malware payload (Formbook)", "value": "20eb8e89be1911a5df6d76d8b0974f06af67fb1dc0ce28bc2912955b5b2ba734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370957, "uuid": "c4b372af-b02b-4827-8e02-628e16690382", "comment": "Malware payload (Formbook)", "value": "a58819c11c7878de44652930107ab1480ef0fec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370957, "uuid": "6dc96abb-3705-4c84-afa3-cbb8b421aee4", "comment": "Malware payload (Formbook)", "value": "bc8bbe890829bd96def972244a9085716fa6fe83891be0cdbf69809875095e6bdc51e40550414a6ff135b2cc6827aa24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370957, "uuid": "ece84d41-dfc5-4d86-a69b-246f32c5363a", "value": "T1E83502992355CD03CA931FB15DB0E37841B95D99B421E363CEFABDEBB87A3852D01281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370957, "uuid": "871e4d4a-78bc-4891-a9d9-c6bc48397a5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370957, "uuid": "50793054-41b6-41be-845c-e4aa4ba4dd8a", "value": "24576:61jR6pFsRxs3PeoLvUVEcvoNP/InrEKkeNXQTfkYZHXqf:ktimRxAeoLsXvyInrEK1GfHJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370957, "uuid": "86773581-2c42-4090-932f-9df4a92b9727", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370957, "uuid": "4ce4e176-cf5a-4495-9c16-4675c54f4bc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370957, "uuid": "6607fdd8-d1db-44e2-8bcb-08b2ac8a2a82", "value": "20eb8e89be1911a5df6d76d8b0974f06af67fb1dc0ce28bc2912955b5b2ba734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1122b321-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369236, "uuid": "93f7c823-0a28-4119-b7f5-85ed74d0b664", "comment": "Malware payload (Vidar)", "value": "7ac5973cdad3cda8d00be62402b2b5d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369236, "uuid": "113cad67-3173-4ad5-b7b3-1f6a3defb154", "comment": "Malware payload (Vidar)", "value": "210fa1c6af0add59d77e4ce91e68f22fc257c8ff2d0c175ebb9534267445ef81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369236, "uuid": "97e806d3-4a81-46a0-940c-c9b0f8063a5c", "comment": "Malware payload (Vidar)", "value": "b0b0af6453769a85682a776535475a5a0cebb5a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369236, "uuid": "79b2330c-d4cb-432f-ad3f-bb894e7a1391", "comment": "Malware payload (Vidar)", "value": "4cb55e7d95e22e9926b6843d8bfaa456fe7dbb6434f36372a9beae046502748d4414e5486625964b38433eafa9b26118", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369236, "uuid": "86409fe0-9717-42b8-83a2-8a16c6dcdc86", "value": "T1CC52D7C6F18321F8C0A9C339C75A1267E5B970821A3A2B3F5BD854A53F8163475AD7E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369236, "uuid": "a108e79b-97be-435e-adab-e4c883cd0068", "value": "23f0624fc03678983bf84a686b8ca727", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369236, "uuid": "97282d10-ec57-49e2-b4c6-44a49247ff4c", "value": "384:OAb4OZD+mz4zTEeu6dwCDYFkWXC4ErmIhwl:z8Ot7zuEViYSt4a4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369236, "uuid": "bda2113a-6c6d-4442-a06c-d805ee8b07c5", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369236, "uuid": "e45b11e0-0773-422c-9394-0aced14b4cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369236, "uuid": "5709352d-3b94-49d7-931e-90538693f696", "value": "210fa1c6af0add59d77e4ce91e68f22fc257c8ff2d0c175ebb9534267445ef81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9204463-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373410, "uuid": "c531fb45-1e49-48f3-8a20-30cf3b1ea06a", "comment": "Malware payload (AgentTesla)", "value": "5e4a8d6b941d10d7f7687fda9ac3e6de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373410, "uuid": "fc5e2fa7-8ef2-48a8-9135-8cbde964a32f", "comment": "Malware payload (AgentTesla)", "value": "218c261e5117a1448c12d6ba65c935480d34debbf1fc9ae0041fd237c5a3a1ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373410, "uuid": "ee533aa4-5cf2-4a21-bbb4-c9f1ea1cd802", "comment": "Malware payload (AgentTesla)", "value": "021f7cec5d2d945e60b22ca5d36e1d9d854028c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373410, "uuid": "7b65f6f9-22f4-48a0-9961-a68324fa4654", "comment": "Malware payload (AgentTesla)", "value": "857f578c0bb98c0ff81a3e0c3a27b08848c4e5e94c4cbe62c8772936dadb197a40e0a3dfa3acc328837c6baa3d6aead2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373410, "uuid": "c77e19b8-5eef-4f89-b410-593262d539ae", "value": "T1362501255316DA42D0D687F6B9B0D3B532641ECFB6E2C2D29FE92FF778193C11960282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373410, "uuid": "bfbe5e08-3486-49db-9cd4-acbbd8d708d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373410, "uuid": "5ec5bf88-ab4c-4a7e-a4c0-65f17c458c1f", "value": "24576:6/IYp50k9aAVmfgdT3L2r8q9JhC9fOS0S/8p/ZBS86FVE:6zpclIB3SgKafbb0p/Zk9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373410, "uuid": "9b529074-e2cb-4a3e-94a7-defd6d00bd8f", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373410, "uuid": "efb5d17c-1397-4fd4-95d1-a4ccc45e9a91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373410, "uuid": "f05e7d9d-5493-4e92-97d4-dcf99821021c", "value": "218c261e5117a1448c12d6ba65c935480d34debbf1fc9ae0041fd237c5a3a1ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ef9837-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368997, "uuid": "c56dd5b7-539e-4883-a384-c8ac4097a36f", "comment": "Malware payload", "value": "975fe30b7d5f61f3611a6821424cd97b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368997, "uuid": "bcc6f11d-daf0-4b8a-aa7b-8874ef0f9442", "comment": "Malware payload", "value": "218e134a8c4d50d8da163690bbbbbfe4d5af0163b0eac9d257d3cc5b2555941a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368997, "uuid": "01455446-954d-414d-8782-7f771f4daf41", "comment": "Malware payload", "value": "9a595787e70d59921640f1e5e5843ca3e9322e96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368997, "uuid": "8fb19725-9af5-4fd5-b694-13797eed323f", "comment": "Malware payload", "value": "9de7aaaf0a0b7e15968a752ab5f1ebb356e746ff349beeae687e41f9a41b37b77330b7be4567361ba7ca9273d1e78553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368997, "uuid": "3a7eda6e-5800-460b-9ab8-11507ea33bcd", "value": "T19A25F1256EC72F91D63D4B78C162098833F0C6179256EB9F3FED10F19EA2B99CD16092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368997, "uuid": "7a3bec12-51b3-432b-a579-68e6d167b8fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368997, "uuid": "fdbbfa19-8568-40dd-b7bf-f95a8c46ac74", "value": "12288:7kVMZebB5kODVKaZuCgHebdfSDl4NHo2agGIEw2GClNsf:defksxDZsR6HzLjEw2GClG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368997, "uuid": "e53d547a-9309-4a99-8575-ff3704019b61", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368997, "uuid": "9ea9c89c-748a-4c32-a1ef-400e5c37d0d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368997, "uuid": "cb0314ea-a610-4cdd-a076-2356d2e63186", "value": "218e134a8c4d50d8da163690bbbbbfe4d5af0163b0eac9d257d3cc5b2555941a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0bcc03-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786370732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370732, "uuid": "0e849fa2-87d6-4e0b-8c1e-c06a55882e7a", "comment": "Malware payload (AgentTesla)", "value": "e083c63317a312fed6f7e21760adb97f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370732, "uuid": "83fe134a-ba68-4a55-bd14-b8385c0ad2e2", "comment": "Malware payload (AgentTesla)", "value": "21f2400b51b84f63f7e610d3ec5890cd5a046bfe63580760b3537a99a557d6dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370732, "uuid": "c4e0e940-9f3e-4f6c-8000-63ca870ebf01", "comment": "Malware payload (AgentTesla)", "value": "af593de5b9f7061387d0cf2291687da283dc3470", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370732, "uuid": "bb0d95b2-6cfa-4f00-ac21-9c8835c187b7", "comment": "Malware payload (AgentTesla)", "value": "bcdbd0dbc353bfe04ab1c4b4ba5cdcb96db5e8a8359c295ee1b431f82a9f2797b9af72cb97e7a15f6ab4b0d5fd807802", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370732, "uuid": "c0e3124e-f348-44c2-a763-0e4c7a24da0f", "value": "T138459E6132DE8783F3FE8EB52BDD747096F0796CD6E9C21D3088669881A6751009D3FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370732, "uuid": "077e0e36-7ade-4e5c-b380-4575ddbcd49a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370732, "uuid": "f8fb483c-e8da-42ba-8030-2035312865b3", "value": "24576:5U50jhwH7krKwIPOr+e4ggVqRXOIJZctv:5uewHsFyggMXOI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370732, "uuid": "28e1fb98-9a27-40e7-8267-8fb757d7ccce", "value": 1191424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370732, "uuid": "fa977284-494b-4825-80a3-46268a04687d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370732, "uuid": "0a0c7d7a-18bd-4f1e-86a2-a82f823219f1", "value": "21f2400b51b84f63f7e610d3ec5890cd5a046bfe63580760b3537a99a557d6dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3add5d1-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371226, "uuid": "b4e02658-8f8b-420b-b50b-a8352b6da463", "comment": "Malware payload (Vidar)", "value": "8db43cde3a816a8fbe05b41eb790c07d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371226, "uuid": "f5ad3c0a-8bef-41a8-aa8f-2c848a0c24fe", "comment": "Malware payload (Vidar)", "value": "2209c288643a3b6df2f55605896268f1dbc2dd0587b450023d30284afef196b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371226, "uuid": "bbc5b99b-b21f-4dcc-a729-0f1f512e672e", "comment": "Malware payload (Vidar)", "value": "5e6df309ee7328a129b072b0d4c35a39511905c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371226, "uuid": "40789d3b-08dd-4024-a498-23c0da9d3d07", "comment": "Malware payload (Vidar)", "value": "77a67ceb8dbe99d56906d7c489565ea6c451e1a6dec6dd69d60290a617a152836d08272195090e24ac64a576b8a0f71e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371226, "uuid": "b780dea4-3adc-4648-b439-035b5eda1660", "value": "T17E923185E1179AE4C4E1C333A76942A725FCB82032355A7F9BDC6A3B4D41370EB642ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371226, "uuid": "c7ca9d9c-b30f-4ad3-9278-ef9c31b8e99f", "value": "b5dedaa92e3b299ba2882a40f166187c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371226, "uuid": "4dbfdc0a-44a5-4d50-be21-90df52d11136", "value": "384:OOL1XRYPFonFJtjur1H28q6fz0gzElvJhvdkqzlj:9L1XRYdZ1lPf+lx04j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371226, "uuid": "ad70b429-2cd8-4bd6-abb9-64b4a4cfbcae", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371226, "uuid": "7180bee4-cd8a-45b3-bc81-aef518d55d6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371226, "uuid": "13b210cb-5781-4262-abb1-db2b53416da3", "value": "2209c288643a3b6df2f55605896268f1dbc2dd0587b450023d30284afef196b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b843b2f-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368394, "uuid": "6b69526f-f886-4247-af1d-28dfdd61801e", "comment": "Malware payload (Formbook)", "value": "ca014779987e06e1e569a5d86e36230f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368394, "uuid": "c0d7ab13-be01-42a8-9b3b-e692b0679f38", "comment": "Malware payload (Formbook)", "value": "22243e2049e0a3d60c556dd7740f096084235ef4590c7d500e89b8bf8ee8dd0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368394, "uuid": "7395f0ca-2f83-4066-871c-866daf82ce54", "comment": "Malware payload (Formbook)", "value": "fb334de84fc4f0c7adddf63cb62eb310345a6bed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368394, "uuid": "aa13a431-1e20-4542-9a5b-5be8a98b823f", "comment": "Malware payload (Formbook)", "value": "a2a87112c4648f505877ca74a8da031db7595bc80349092be00e163dd7c4b64306dfa403d56cd01c8674dbea33a87a62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368394, "uuid": "977defa6-c0cd-48c3-a3d0-4a4cd6f9e2fa", "value": "T19F3502C43B2AA715DEA40530D679EDB452E92DB8B010FAE369DDBF4B79AC2109D0CF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368394, "uuid": "0f34116d-84fa-4ded-bbac-d1c76e5ef800", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368394, "uuid": "3cb4cc4a-d19c-4c81-906e-7613fa96af0c", "value": "12288:nm1b/PNehQrI91U/F7woMMzQJ0eW22gCf+/EavLjJPU/kkJXlKoCwSHvq1qr1:m1BuU9MJDCG/ESjekWXsoCwSHvq1C1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368394, "uuid": "d66691e0-2370-4e9c-bc2b-3e952ebc1c01", "value": 1095168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368394, "uuid": "d31c1136-3f73-4a8a-9aad-cf80632103c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368394, "uuid": "79bc0dfc-bad2-40e8-a5b7-4c73691d96b5", "value": "22243e2049e0a3d60c556dd7740f096084235ef4590c7d500e89b8bf8ee8dd0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a457f3-94f7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786392589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392589, "uuid": "89899e1b-6149-41cb-ab7d-f0f1cfa5a240", "comment": "Malware payload (Mirai)", "value": "750143543e57811c043cf7017460fb50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392589, "uuid": "f0dd8d32-365a-434c-8ca2-1a9b356fb5d9", "comment": "Malware payload (Mirai)", "value": "225ab724cb87e73be3995491d30b0d94c8da9c05c821deca78e5835ab470e574", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392589, "uuid": "73cc5ce3-7734-48d9-9be9-c47812982868", "comment": "Malware payload (Mirai)", "value": "18f470a555f4a60b051563dc8e19b6d28df57d94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392589, "uuid": "61582abd-98bb-4e14-9103-e9ee3b4b66e2", "comment": "Malware payload (Mirai)", "value": "6efd0803efa02db982bd81374a19b4127697080f3d282918fe34948c420cdc94b00b6701cee035fe357cf16d73942635", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392589, "uuid": "d6986cd1-4163-41c6-bccc-9a930d6fe8f4", "value": "T12DC30A52BD429F13C6C321F6FBAE46583B126B7CD7EA3102E924BF50234B8DE0E26551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392589, "uuid": "9692cc06-d231-4079-aa89-3c5fc130e6a4", "value": "3072:khv7ugRMxmXlL6uVqDzIewgIVT78kjxx9EO:khvHlL6mBewgwH8kxx9EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786392589, "uuid": "e01453e7-1365-428b-b7c2-5c91003b98a9", "value": 125568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786392589, "uuid": "3630e983-d1a1-490f-8ce8-b822e649006d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392589, "uuid": "c5216992-b141-47cd-bf7c-fc0b1f8fed27", "value": "data_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c7c5d3-9461-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786328019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328019, "uuid": "c2e88934-395c-4d58-9670-ccab83b87b30", "comment": "Malware payload", "value": "e618014ef07e84bb9f1528837eae666e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328019, "uuid": "a8c91501-32ca-4dab-83de-1fac8014cbf7", "comment": "Malware payload", "value": "22804a77a4bfbc5f5df66ee61f8cdd422b0ea2a589fdfc6667b3ea58fc2c0ab3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328019, "uuid": "23866e44-3648-4d17-8454-52d1a809c36a", "comment": "Malware payload", "value": "74fc15de4c8e4d852b989f9d6f328ed8a70751e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328019, "uuid": "c34e71f6-5acb-4167-9b11-cac7d5ab3e09", "comment": "Malware payload", "value": "2522df6a34b3fa527065f16c77249b00cffd809116b077f22ba4b11d308b105375adc24e92ea3c16c9c3342b6952647f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328019, "uuid": "e430bf46-59c3-4a2a-9da5-8bff1d4a53ce", "value": "T10253D71BB6A3B0BCC247C0B45A9AD5B1B9317CB002213D7FA7C8FA312935E416659F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328019, "uuid": "ff39d9fe-ccd5-4880-974e-955564a60d06", "value": "1536:FSW6tN+bRAIxS2J7D0yWwwXuvZCi4IVRuGW2EUr:FtbRA8RJ7Dsat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328019, "uuid": "038387c6-bf61-49fe-8184-0481c8490b03", "value": 66640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328019, "uuid": "2a50f40c-4d48-4977-9aa1-c90730f3474a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328019, "uuid": "e5227c97-6101-45de-8ede-846776f868bb", "value": "main.x86-64-i7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2919290c-94a5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786357250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357250, "uuid": "13099f80-7bf8-46d2-8095-0d29da8a1f56", "comment": "Malware payload", "value": "08dbcb220edbfa9f576057e64861600a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357250, "uuid": "e23c7968-f5b6-4235-abdd-ffce37dc2497", "comment": "Malware payload", "value": "22d379e19805ca9121f19f3148a3c99aa23fbaa2b686f0bbf24f9ef45c32388e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357250, "uuid": "238b7ec3-41ab-494d-946a-7286d8b73dbf", "comment": "Malware payload", "value": "943d7d1bb4608bc0bde5862b4de683aec821f1e1", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357250, "uuid": "ea2e410e-3bce-460c-9969-b8b21868c8d4", "comment": "Malware payload", "value": "a2748a5e4f766daeb1005de985846c3eb04fa84f40032f4f6a721dc6559dfe5e2f2f747b466ba1401166601c95cbcbd8", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357250, "uuid": "44961ebe-20ea-4845-899d-603e4cb37180", "value": "T1CD32F6CCAF9063B4F29703CD37AF2999132661CB904CD984F64C6DF06F4B68D4A46E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357250, "uuid": "5d7782a2-9d04-4ac0-9c23-069ce596c2da", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzjlX42AiYOpzfMclFl9CX:sXX+/DV7k/3jlLAiYOpzEa9CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786357250, "uuid": "6d20ce31-5e72-4209-a753-d3c20fb22d61", "value": 11994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786357250, "uuid": "4907a45e-572c-428d-a8d5-661dbfc08fa3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357250, "uuid": "7ea9ca7c-2e3f-4c1a-a4aa-873cb2804931", "value": "rooming.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9248d312-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371170, "uuid": "5b94121a-68cf-45a1-86f3-50cb95d65c9e", "comment": "Malware payload (Vidar)", "value": "cbf643d4160bbd34578dcfb3b34d686e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371170, "uuid": "3f0dbe81-8e6a-4b3d-897f-f13242c4a872", "comment": "Malware payload (Vidar)", "value": "22fb3b615773edfb1af40e88114d066b15dc089616c7a865dc4788fd37371ce1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371170, "uuid": "25f39503-4588-4ebd-9f6b-f82c47a64549", "comment": "Malware payload (Vidar)", "value": "097b5c5db936eb41e089d7aeda657cd90a8bd410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371170, "uuid": "bdaa3d43-e545-4418-b839-2fc8d70747ff", "comment": "Malware payload (Vidar)", "value": "2c5e8647f8f3cc489d6d7da10660ac13ceac8713a861246ee272d2df96f0dcbe22946e2ca924321ca7a33b10d4d3013a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371170, "uuid": "117d7b19-751d-4b67-9838-1cb9d6e65735", "value": "T1405208CBB1A351BCD0B9C37DD64A01EAE772308207265FFF07EC87142BC6A1036A8A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371170, "uuid": "f13ba81a-93b4-41df-a166-a666cbf29e23", "value": "e94e649e836c8320627dfabdbb134df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371170, "uuid": "ef2f65e0-55d6-450b-aaf5-aa4fdfb73b3a", "value": "384:OjuV/b9KRPIIFbnR9mSfZbqkrbl2NDKYT1TCsCg:eBbnbmub32NDKYT1TCsCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371170, "uuid": "e453178f-001c-4a7d-a857-278542004eff", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371170, "uuid": "484c8a25-4f7d-40c0-ab1c-7668362fc9d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371170, "uuid": "3636ea17-e918-4ee4-9cc2-9ad54e2b96f4", "value": "22fb3b615773edfb1af40e88114d066b15dc089616c7a865dc4788fd37371ce1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b5157f-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368832, "uuid": "9427b02c-ab44-4280-af4d-81193ad47703", "comment": "Malware payload (Formbook)", "value": "8d092404d0a2022ec19b7a4c32692d22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368832, "uuid": "ca2164b6-8559-4218-b0b4-858b29850216", "comment": "Malware payload (Formbook)", "value": "232133d7659d0b8491114ebc60bdc27c02b7adf41299ca33fb6ea53445b397e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368832, "uuid": "d0dd15b3-f41c-466b-9676-70c6074b140b", "comment": "Malware payload (Formbook)", "value": "8840e74883ce76a33feed4536b5d9210d7cc3097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368832, "uuid": "ba2bcd3a-ef32-4837-9803-8da54154f1a9", "comment": "Malware payload (Formbook)", "value": "e48653cf45b33bf0896c0f87394ca8ab6661a53bd11ba459d890d88b5a3f0d07f29c2dad40b0b241683b0d323c9bc20b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368832, "uuid": "1128fc02-2524-4e5d-8060-f9b2f71bc4b3", "value": "T15E2512402699C501D6B997F88A72F2F103B13C6EE901D6678FE8BCDFB8327416914B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368832, "uuid": "ebb9487b-93c2-4851-83d5-824a7d9e5ff7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368832, "uuid": "726b8f40-c3c5-458e-9856-b1fccbcd9e03", "value": "24576:65Q4uq/QeByrbyWHPV+o0BffJA1rG75iYmEM1nChzv2cWthX:UQ49pIbPVK3JirGo7n+fmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368832, "uuid": "75820a9b-e0d5-48fb-9de7-73b6696d4f5a", "value": 994816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368832, "uuid": "e8cff485-4e4b-4d18-91ee-c34e38db2662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368832, "uuid": "f02fd35d-4db6-49d2-a5ec-87e733ff21fb", "value": "232133d7659d0b8491114ebc60bdc27c02b7adf41299ca33fb6ea53445b397e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837bf84a-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371146, "uuid": "c6de23ff-77fa-44c2-8d2e-b035cb365ea8", "comment": "Malware payload (Vidar)", "value": "07836a414348a3d5684e3f393c8acb16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371146, "uuid": "5966b6b0-a151-49c2-9bd3-a5bd6b2471e5", "comment": "Malware payload (Vidar)", "value": "23291fa45184b121f7a59346b4e97083cb17444b311e43600bc230aa7a4406e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371146, "uuid": "09058ae6-0e51-471a-99e6-8374a24a0a1e", "comment": "Malware payload (Vidar)", "value": "4d5b15ab26b2715bd67f172604c4a28b0671315c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371146, "uuid": "0635eb29-b7de-4a7b-a9eb-3c9a94699495", "comment": "Malware payload (Vidar)", "value": "9e90ef935f7a0d3000cb79e51b47f86dd7e7c9632659d6090828bbd1213c92ff079117a84a1f2adc991d41b9a39c178a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371146, "uuid": "a1286108-62a2-400c-8715-613dbc5161f3", "value": "T1E7827F45E20B52B5C4EBC3379766561316F8BC013135673BABECAA721D42730F6282EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371146, "uuid": "614540e8-9f74-4d2e-964b-0327386ab49a", "value": "23f0624fc03678983bf84a686b8ca727", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371146, "uuid": "096f968b-cfaf-40dd-b8b2-16be78341e7b", "value": "384:OamvmYXwZf8sUCLnwbNVW/4vqQvxOC6bcRiauKlx:GmIC4NVWgfvr6bcRiXEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371146, "uuid": "850bf523-fdd0-478d-8fc7-bd0ef596551d", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371146, "uuid": "59ab4a7e-c2d9-45ce-91bb-bcd1ddba810a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371146, "uuid": "f2393f8c-8b03-43cf-8c89-93161a789adc", "value": "23291fa45184b121f7a59346b4e97083cb17444b311e43600bc230aa7a4406e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa71c07-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373225, "uuid": "7e61174c-65e7-4421-90db-6f5113f374e5", "comment": "Malware payload (Formbook)", "value": "e21fe731e011bcf0a181f2c894da220b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373225, "uuid": "97d593d6-8135-48f0-8065-e052923e4a63", "comment": "Malware payload (Formbook)", "value": "23a8568003768b2f4e2fc3bd47a6d6d054c11ce622737d27df4c4f1bb0c28146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373225, "uuid": "84785aec-b62a-46b7-b5e6-2650013da6cd", "comment": "Malware payload (Formbook)", "value": "11af95f07370e84620ebb8d0feca1920035bf3f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373225, "uuid": "74c1e53f-a514-41b4-9635-7701a0232063", "comment": "Malware payload (Formbook)", "value": "65e5172b56688ad02214c8bec3dfecba8c9c52858995e2298df40bc038fed2851d6e28b7517be61a03417a42b4eaf21e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373225, "uuid": "91298125-0ab5-4b69-8e9c-ce83f05a1473", "value": "T14F542306EBD391F6CDA08031D6CE15A609BF5C75E3D5F80B3B81A6CC8B752BA1E99350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373225, "uuid": "8ff7afe1-5976-4c20-a00a-090c7119b43e", "value": "6144:rZ1jy/W6CdFAe6+RL7BD2x+K2rvF4OkJnp3D2sVAATmoAAx/XQLc:zjy/WMe6+RlvVkZQEAUmoZ/XQLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373225, "uuid": "f4e81a50-34d8-45a8-b53f-a040f5a47c4e", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373225, "uuid": "19b0e894-3f6a-4ff5-89cd-563da7256f02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373225, "uuid": "c8858c0b-3e63-42c9-8711-547bbc74bcc5", "value": "23a8568003768b2f4e2fc3bd47a6d6d054c11ce622737d27df4c4f1bb0c28146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a118f7-94fc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786394617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394617, "uuid": "166b6c53-bd3d-4873-8c01-89ef0237640d", "comment": "Malware payload", "value": "3676ba305ed080b8b895b2aae5b4b212", "object_relation": "md5", "Tag": [ { "name": "104-236-230-184", "colour": "#2C5BBF", "exportable": true, "hide_tag": false }, { "name": "charmingKitten", "colour": "#BF8150", "exportable": true, "hide_tag": false }, { "name": "greenspile-com", "colour": "#AD5BE5", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394617, "uuid": "07d0b446-84f5-49dc-b33d-0583146ce87b", "comment": "Malware payload", "value": "2447a57cee38107f77c46a531095b4fffc5f2af604e945396172b4f3edb9188d", "object_relation": "sha256", "Tag": [ { "name": "104-236-230-184", "colour": "#2C5BBF", "exportable": true, "hide_tag": false }, { "name": "charmingKitten", "colour": "#BF8150", "exportable": true, "hide_tag": false }, { "name": "greenspile-com", "colour": "#AD5BE5", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394617, "uuid": "8ab6534e-b2f3-44f2-b545-93baa1a062e1", "comment": "Malware payload", "value": "c9920a6b209bee0521a84be33691461acae64fed", "object_relation": "sha1", "Tag": [ { "name": "104-236-230-184", "colour": "#2C5BBF", "exportable": true, "hide_tag": false }, { "name": "charmingKitten", "colour": "#BF8150", "exportable": true, "hide_tag": false }, { "name": "greenspile-com", "colour": "#AD5BE5", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394617, "uuid": "94584d2f-0614-406b-9589-068206d8692b", "comment": "Malware payload", "value": "e1a1813fc2f2731f70c6f40ad5e5dd1073378f6555871fdf3a417b796e31fd74987369174197567f4befb2bf8fdf3148", "object_relation": "sha3-384", "Tag": [ { "name": "104-236-230-184", "colour": "#2C5BBF", "exportable": true, "hide_tag": false }, { "name": "charmingKitten", "colour": "#BF8150", "exportable": true, "hide_tag": false }, { "name": "greenspile-com", "colour": "#AD5BE5", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394617, "uuid": "341a0972-933c-4592-8684-4cc0d24ec78b", "value": "T13C9285B1B70ED99F1763076A9AF135688D2FC1BD25540BD0F49FA02AD7F8948058D2F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394617, "uuid": "18ae00bf-e130-4356-a434-7ff962be4c28", "value": "192:+hXgNoNSAk7tNn3W/4mQJfv55531w+JRmp9J+AUJQRLniwjD4iXt9i9kYrgEH9h:65uRmpb9hRLnrfd0kHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786394617, "uuid": "ecd0e147-74dd-407f-8ee8-8ad2d8d90865", "value": 21076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786394617, "uuid": "30389c14-f760-458d-8c87-9b84e8551c8f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394617, "uuid": "5a2fc4e3-1651-464c-ac43-df9ccd70d751", "value": "iis.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea8e4f1-94d0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786375674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375674, "uuid": "ce28e6b9-db1f-4775-ab3c-5a510ec24662", "comment": "Malware payload", "value": "f96d658f3a06730e88c6b1e39ff4b054", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375674, "uuid": "095c57d3-eca4-4b7a-a9ca-d7dbc5e62374", "comment": "Malware payload", "value": "244998b9eb1d4c64ae37c76010651b0e63307ac8a9ac454884aed7b3d3582227", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375674, "uuid": "c8259d3e-c741-4df0-81fb-38c9adfc8343", "comment": "Malware payload", "value": "168ae703ebee17886422449c91d93c3d9e876235", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375674, "uuid": "041d04c8-10f0-45a5-bcff-462d039e3365", "comment": "Malware payload", "value": "b335f1e523bd001fd865b67b6a76f95843255b2b22574095cefc41736e51e69f9e7e83128e0667ae1253db9f19bcc265", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786375674, "uuid": "55c7738f-e4f2-43a1-b466-1a135d3d228e", "value": "T18FF08C03A48BF036808439A8EB76F75AFC24BC476262CE4CB840BA50DED64247861240", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786375674, "uuid": "958692e2-8215-4d59-92c6-54dd6cbc5185", "value": "12:lSjhh1OL9ephRjk4Y4bou7Co1VOq2xddNizdI/HXu81lt:lk1gYpTr8i3fOq2bf8IGMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786375674, "uuid": "82bd85f2-d721-45aa-9db0-b0b56a413145", "value": 495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786375674, "uuid": "6d1c15f6-0455-4539-9c64-76b3db2cbc01", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786375674, "uuid": "d834b64a-9694-4250-bacc-00b924661bbc", "value": "bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b15f00-94e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786384348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384348, "uuid": "453fb317-f061-4903-88ca-77a5d2a3d01f", "comment": "Malware payload (Efimer)", "value": "7ba1aadad4a85a60ed8d531779a12422", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384348, "uuid": "5c3ca249-68e2-4a3d-8965-4225d5cb6ef9", "comment": "Malware payload (Efimer)", "value": "246d4bf560910e8db5f1a2b5c28bf6252fc3eb6fc6797f8d9a7b5beb8eade556", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384348, "uuid": "24f4451c-d5d9-4f13-878f-83a31975cac1", "comment": "Malware payload (Efimer)", "value": "d3ba419e0cd5c3344ab12f6a126292260f570179", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384348, "uuid": "2a4003fb-2ffc-4a91-bcbb-9edf31e64c26", "comment": "Malware payload (Efimer)", "value": "3ef793467fea729ebead0f6a98751b488106147c8a7d95b20f7c475285da4ce4ab83eeb15eba5e89317034f755f2c92f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384348, "uuid": "ddb645d8-6c4f-4136-82a1-72bddebc1fe6", "value": "T1ADE6334D7BD012FAE9E38038DFE002B5E22978B54772C5CB979457916D932E08E3E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384348, "uuid": "7967efd9-3a34-4550-8d17-5e6703cf3e1e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384348, "uuid": "a0325c42-3d41-49e7-ad30-17ee6fbeffb8", "value": "196608:W8EGqSFP2SYdfDK8NZKJBVIAtqUv8tXMCHGLLc54i1wN+MKPIcu9KYK39sI3PPG0:W8Esh2Sm4jL6XMCHWUjccuI3/PGTAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786384348, "uuid": "4e1bfa9f-6e15-4845-bd89-ac04c10a932c", "value": 14078229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786384348, "uuid": "03e9e035-e86e-4c52-a3e2-a1b03859787c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384348, "uuid": "6d75f7f0-7b9c-4027-819f-36d0c9b4d4a2", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcab00a-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786372482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372482, "uuid": "49089b19-04de-471b-9878-c5b52a4c824a", "comment": "Malware payload (AsyncRAT)", "value": "923fd65806ce746ef544cad3d1568a7a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372482, "uuid": "0ce6e9cb-f06d-40f9-b8ba-f096aefecd18", "comment": "Malware payload (AsyncRAT)", "value": "248d6fd4d064a4ced3a75ee493a43afb2a909d3c14726150685fb26147fc8d3b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372482, "uuid": "086520b8-0dc0-4084-a9e7-0595421a0e82", "comment": "Malware payload (AsyncRAT)", "value": "ac75741b8422118cfcb330315b317341ab8c5033", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372482, "uuid": "ff786567-ae33-49f1-bca7-0824ce08e74e", "comment": "Malware payload (AsyncRAT)", "value": "7adad4f5f27c4478c65343fd9b87907207a56500e541a12cad196b9d1187a636bcc5f677b7caa8478e8091a6130a583d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372482, "uuid": "14be17b5-46ac-47ae-abb5-ee06b754c88e", "value": "T1A335E15462F5EA4CD2518BF308F0D1305BF1AC19A92CE24AB9F5BFEF7A7624121493B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372482, "uuid": "208cd34b-99e7-4e92-b1d5-8cbf7a394b41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372482, "uuid": "51c521a0-ff03-4ef5-8fc0-60a8b5bbbcfb", "value": "24576:NO+Lqj/Og3rVZzdcH0CBszfFJs6p7kWZlG:NO+LIPNcH0gszfV7TI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372482, "uuid": "5b38ee5b-4afe-42ef-b5f2-ac3dd13db361", "value": 1122816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372482, "uuid": "adcab5c3-6044-4862-95ff-2e0abdc4815a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372482, "uuid": "5da1d48c-deff-4522-8b8e-237c41f54683", "value": "248d6fd4d064a4ced3a75ee493a43afb2a909d3c14726150685fb26147fc8d3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c944c0-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371903, "uuid": "c70f8a62-531f-49cc-b76d-d83f967a5d55", "comment": "Malware payload (Vidar)", "value": "e9f9365fc978fc8ce169cf7a95e77ac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371903, "uuid": "c6c1d618-ea33-4ef8-a25f-6be27c6087df", "comment": "Malware payload (Vidar)", "value": "249b0b9d87c8328e1b66f69c2308fdb1ea793c3e50d3d7522291c779789fe104", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371903, "uuid": "85f5e98b-a1e7-414e-a764-68e0070613d1", "comment": "Malware payload (Vidar)", "value": "78054a9c010a6d55ddaa0a169b338f914841b356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371903, "uuid": "ce60b468-1dfc-4095-a479-fd8ed30826e5", "comment": "Malware payload (Vidar)", "value": "d6fa4c07b66267e4db5528f2b60ad51fe933bf5b536ba20a13e2617870e0ac05b798d5f80b4d98115dd1bc6781750847", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371903, "uuid": "81c8dc3d-1a39-4361-a626-c82391ed2dff", "value": "T19042F783B2C4C1FDC1CAD37899AF14BB9A31398407A696FF7290C8945BC7656B63C981", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371903, "uuid": "d48de931-f51e-414e-9c27-0b49d438bb24", "value": "4771e6f45e35660c0a3e9d4423dc0d86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371903, "uuid": "0ff2c487-5554-4308-b01e-1b8dd889ad93", "value": "192:O4IP531CqztN08OqcGlzzxcRC24aBq6ZYV/ublUl/o3VOfD:OHN0fqL24L62Nub+olOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371903, "uuid": "1b499abd-6434-442f-9a4a-10d0929e2c61", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371903, "uuid": "6612be0b-3a15-4ee0-a1f5-3d6e71d1f8a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371903, "uuid": "d6adaca2-8807-411e-8c1a-adc0829741ab", "value": "249b0b9d87c8328e1b66f69c2308fdb1ea793c3e50d3d7522291c779789fe104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e66297-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786357035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357035, "uuid": "e37867bb-a75a-4bdc-9cf7-0a1c40a2ee37", "comment": "Malware payload (ConnectWise)", "value": "ae9893c7a60b298f3f45b85726e09a98", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357035, "uuid": "e73ce713-0cb3-47a2-9878-c0bf26f59c6e", "comment": "Malware payload (ConnectWise)", "value": "24d5d3e5095d9bd866d657c646d5c4035e64315c7ba3c17b230415f0bef8c0d3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357035, "uuid": "df41ab74-18e1-4a10-9a51-8f93c51ef2cd", "comment": "Malware payload (ConnectWise)", "value": "eb63f8a9af89d85b71ca649ed826c4244aa81e39", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357035, "uuid": "d92c049e-822e-48b2-b675-d2b683d0e235", "comment": "Malware payload (ConnectWise)", "value": "f5e12ec208ca77bddd675efddbd852ac80a69348cec633df475644eb6311857ae71ff36030b9fb951a08d5821058b31b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357035, "uuid": "5987e0da-9b7d-4874-90b8-2fd099183809", "value": "T1D446E101B3D695B6D1BF0638D87A56696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357035, "uuid": "d0e57bdc-4f7c-4d77-a29e-9b07ee9af8c8", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357035, "uuid": "4972b54b-2c5c-4a53-b942-9127ce9f45a6", "value": "98304:OzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlpO:OhfefPtHxcp9ym3nltDUJVbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786357035, "uuid": "82d59a7e-7766-4295-b6bc-3d541d4733de", "value": 5789624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786357035, "uuid": "0d38faf9-458a-4906-b5b6-d7c8fb521eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357035, "uuid": "cbe48c04-b662-4060-b97f-1dc1def3146b", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbd5248-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370384, "uuid": "36c2e97d-7dcb-408b-90bb-6769f1d42c6e", "comment": "Malware payload (Vidar)", "value": "f26b02228093fb9ea2970b1acfb4757f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370384, "uuid": "04d5b61a-ce35-4ecb-ac2d-b52ecf15467b", "comment": "Malware payload (Vidar)", "value": "254b3dbd0414cb9b5dcd6ce3e815615fb3db9ed76642824ce644609730173037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370384, "uuid": "995a5e75-86fd-417f-b2e6-16d0c8ec4205", "comment": "Malware payload (Vidar)", "value": "432c12c0b4baf795e99d9e52c3c8d1978c1f84cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370384, "uuid": "de4c81ca-8ef0-4391-8340-e36bddebe36b", "comment": "Malware payload (Vidar)", "value": "fbc25f62b33353a4d5615d6949d98f4ff57112fdbe9143b964bd86c0552a8e3bebc3762dda682eb70ed72abf1df40339", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370384, "uuid": "130ceb1a-44a7-4a40-a18a-697c9ddec277", "value": "T111520BC6B18324ECD178C33C8E5F06736B6630A613195FBFD9EC09A016826513A7CB9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370384, "uuid": "1e7afa13-6e85-4c93-bdb9-1e0700cc4026", "value": "351526ecdd2e2b685a290935bb32a240", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370384, "uuid": "44795e2e-8169-423f-91df-3c2ce8b6974e", "value": "192:OTT3DPMfnlrxdTwgtXQ7lKJBJ+kXOWl7ODETiV+K0fwzD3V9FX4/d:OfzKlbTvtylKnokXX7ODycUwDl9FXcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370384, "uuid": "d272820c-4928-4a10-a997-e30aedeb755a", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370384, "uuid": "0516e80a-4686-4342-9ad3-55059d216be0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370384, "uuid": "f1d3926b-70dd-4547-b9af-8602b8df50d7", "value": "254b3dbd0414cb9b5dcd6ce3e815615fb3db9ed76642824ce644609730173037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942ec074-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1786372462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372462, "uuid": "92cde8b8-9264-4305-860b-f29d0f8c0c41", "comment": "Malware payload (DarkTortilla)", "value": "78fd5a813173323ab23bf02192496c9e", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372462, "uuid": "59874e23-5335-4dfb-b15c-e74d9d07acf6", "comment": "Malware payload (DarkTortilla)", "value": "256ef225565388227fd67c6e4a8c6e1990df8f660fb4504813c31bd57d9269cb", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372462, "uuid": "def92bf0-4fbd-42e5-9ca6-8bb3a10028a5", "comment": "Malware payload (DarkTortilla)", "value": "63ee17dacdf50aaa4f49c6fc86c82f6afa73faca", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372462, "uuid": "50b06183-827c-4a67-9577-23a99265d8c6", "comment": "Malware payload (DarkTortilla)", "value": "3208f824d88aaa15e22c951935272ea00914e51b90592911536086e4795da571f08662c983b4d9bdad28873bf1e09772", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372462, "uuid": "7b76455b-7f3e-4d9c-9a7e-3247b604ff18", "value": "T17445F11A13D4AA68E4FEA73157B4001147F2F80B9736D71E6D4C50EE5F32B829A66B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372462, "uuid": "1f6a63d5-a8f6-4189-8428-f5ceb2258e4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372462, "uuid": "dd20e954-2483-4fa5-9662-c301be1fae44", "value": "12288:pUq7p14OFyLHK9Jwe4ezKWusA8Z2vjtxIcYzLzCZeGRpQ6s7EwKz4RH6uG/dD:3UOF8HKLZ4e2sAh8cYHliKkzyv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372462, "uuid": "62878108-eeae-428a-a327-f6b92bca14db", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372462, "uuid": "d61e860a-c50f-423f-9ba0-be575aafe0b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372462, "uuid": "9eaf3aa7-7f39-4a6a-8e1e-b39a56fb7e0c", "value": "256ef225565388227fd67c6e4a8c6e1990df8f660fb4504813c31bd57d9269cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f49376c-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373662, "uuid": "baffd004-3f64-4fb4-8c8b-71ab8287f134", "comment": "Malware payload (Formbook)", "value": "c3452fa146426e3210a7f56276df2f96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373662, "uuid": "371f6b6a-3b52-4055-a772-1c97728be388", "comment": "Malware payload (Formbook)", "value": "2598b0f8297dc652e3fe52b3912895d9f81f6435ba0f7ffa00d71c491fc914a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373662, "uuid": "54261081-7f28-4306-936e-619dbb46a2bf", "comment": "Malware payload (Formbook)", "value": "6feda9804670ebf1c5425c605701e3826a44a6ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373662, "uuid": "13147aca-ab41-4b09-b615-ffeadfb2d44a", "comment": "Malware payload (Formbook)", "value": "662b38fd946cf64566d805f56e4a368e9eae86e2ec6b7441f3b653999c7bb7f6130b83014d30d17d5dca7efa9201b84a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373662, "uuid": "62852ec7-1440-49fa-93d7-0ddc8fda73e0", "value": "T1BC2523294B918D53E54716FD489AF4F123B2ACDCE26AC69B4FF85EEF75837348820241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373662, "uuid": "d1b02de0-8ad9-4829-bb4f-1c6c6ed7f0ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373662, "uuid": "50de044c-0680-4e95-8df5-3d89ac852f9d", "value": "24576:csypuh8y2D8aZ2z4P6j39HqyhrVDhOqx4:csypup2z2z4Py3MyhJAqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373662, "uuid": "840b9783-c235-43c8-b625-7959f19fd363", "value": 1011712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373662, "uuid": "aa865ddb-89a1-4b97-9d9e-1c96ebda3022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373662, "uuid": "e989add3-4dd7-4a87-848a-4c54461abfdc", "value": "2598b0f8297dc652e3fe52b3912895d9f81f6435ba0f7ffa00d71c491fc914a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226ca04f-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373560, "uuid": "1b50de22-797c-4305-881d-0a05829ec861", "comment": "Malware payload", "value": "9e86919ccc1e4c30a31759c5499f502d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373560, "uuid": "94933ba6-eecc-4146-8f55-e6abe6985692", "comment": "Malware payload", "value": "2605b24e59d3ecb1bca62d27a267a691373cf31343aadc5fbeab39f4554ba3fd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373560, "uuid": "91ff624d-1b55-4180-a8a5-2f191d5c10ca", "comment": "Malware payload", "value": "df1028078381265acbc763c11a0ae723b9bbf05a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373560, "uuid": "a12a3255-2a3d-4e0d-a1e7-0de12c000f54", "comment": "Malware payload", "value": "0f7d0ed5fa58864c87028a404073d5dd324b4d90beb284664070adaa8e5e93046d14ad3a67e74c75c1a54030ab0f558d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373560, "uuid": "73447c87-7bae-4417-a214-4ef02d67f44d", "value": "T1CEC28D956A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373560, "uuid": "6acf3e53-2051-42e5-907a-50138e38aa36", "value": "768:b8vCB+25j6es8Rp9FYpMSUpi+20qUpi+20YQX:b8l25JPd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373560, "uuid": "314f9a43-8d9b-43ed-b95b-64c2272a53d9", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373560, "uuid": "6eb545fb-98d2-41be-9c5f-b8d6fea5141a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373560, "uuid": "3a1d7519-8f05-487c-bd8b-3857e840bf3b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dda0a67-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371082, "uuid": "56527d8e-d7fe-441e-93f4-51247cded155", "comment": "Malware payload (Vidar)", "value": "a05271673f0563cb290da455ade53d2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371082, "uuid": "ea74bced-e93c-4cfc-8e92-b8e076baf3fd", "comment": "Malware payload (Vidar)", "value": "26bcb076eb027815530ed04dc3edc4bd5bb694dd77a10a0aa87f14b405123486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371082, "uuid": "150124a5-6759-428d-a466-96e04dc7b46d", "comment": "Malware payload (Vidar)", "value": "8dc9ff2be1acea02099ab0058471fdb594eaf2cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371082, "uuid": "20d75b63-3c09-4107-8099-113c0a3cfd0e", "comment": "Malware payload (Vidar)", "value": "ca3d7811f00c1a1fc982554abde3d85023461e0f1ea39570a47ce97274104eb37b03eb2eb9c98dd9cb7f389955d3121c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371082, "uuid": "2c23012c-8ad4-4576-9841-b935401d0c46", "value": "T1D54501242EC72B48D97D0F78C16A1888ABF5C5439312E7EA7EED01F4DE72786CD26416", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371082, "uuid": "47cfbfe5-d5e4-4a69-b09c-c292bc5cc3af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371082, "uuid": "59b99ece-5204-4c38-ab86-4261d01aaa2f", "value": "24576:uq4OC48Eq5Km1Z/rM655yJmg6K4lOVALNUSqkQOq7:t4OC4qDZ46OJmg94EALmSQOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371082, "uuid": "521ad5cf-299d-4be5-a4af-34998da7dcdc", "value": 1182720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371082, "uuid": "34ca05cf-c422-4a8f-bf1e-e0d48614d103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371082, "uuid": "8a1d9da7-150a-4497-8bfa-d73078ab0d96", "value": "26bcb076eb027815530ed04dc3edc4bd5bb694dd77a10a0aa87f14b405123486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdeb950-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370791, "uuid": "88c4ccfd-b038-428c-bdfd-0300de8dd74c", "comment": "Malware payload (Formbook)", "value": "96924e7ef128d42f420749c681d49750", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370791, "uuid": "80c4d628-04ef-4248-8da5-c1a0a3582b11", "comment": "Malware payload (Formbook)", "value": "27049c68d4d7422d51737fc4dd9ed5afeb348c130f4ffbac24817fca94902625", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370791, "uuid": "a0a74973-6c0a-44d5-af83-8ae2be3acaf4", "comment": "Malware payload (Formbook)", "value": "1be16572fe13cd5b881379ff96ef285f64efea92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370791, "uuid": "db03aaef-5c1e-4bae-9204-9d19ba914ac6", "comment": "Malware payload (Formbook)", "value": "07431284a3f077d7012dcec93649845cfa30aba112701f51036098dc3cc07db4969f9f5618f025a15f68f0bf320b5945", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370791, "uuid": "a4810926-de0e-4bca-b82f-f0e585cdf5d4", "value": "T116351248AA49C810C5C70B34C860E6F603F2AE6DE521C69B4FECBEEB7D767016D14B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370791, "uuid": "d48674e6-7b47-4ebe-835a-d703d86d924f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370791, "uuid": "65d09ada-daf7-423e-9a40-aeed5ffebeef", "value": "24576:0kTz3kiKZGtP+JWavhDZcDN5oMPXYGKvVKY0PxuDJBQdJHVQ6BTt:Jv3kJvhK5jP3KvsYIxuDJB96BTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370791, "uuid": "071fa0e5-d683-4460-af72-d4f1c1ef6081", "value": 1132544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370791, "uuid": "48fb4457-ed9b-4f2f-863d-ecb9c5ce5332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370791, "uuid": "4d150beb-9ae1-4873-b630-1846f022b066", "value": "27049c68d4d7422d51737fc4dd9ed5afeb348c130f4ffbac24817fca94902625", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf12696-94e7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1786385711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385711, "uuid": "eba6c428-06b3-4885-9ee2-a74ce6c9c99d", "comment": "Malware payload (Stealc)", "value": "03b6ed7086933a7082905360bd9803d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385711, "uuid": "b3fe25e0-9a0e-4eb3-8622-7178b1964fa8", "comment": "Malware payload (Stealc)", "value": "2722e3fa2347b1a5c39b44773baa719a3bf1414b82814b780a5872e21cd3c9ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385711, "uuid": "306aa632-ef2f-4cd5-899f-bf12dab7b635", "comment": "Malware payload (Stealc)", "value": "1e33f322e55e90b4ac5be3594b4544a7f87d2397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385711, "uuid": "7cc9b84f-b5bc-4f41-8106-b1ccbd6d5b95", "comment": "Malware payload (Stealc)", "value": "c5de4624d25ae87e38ec79e765115a21db8ada52dabd0b0e7fe4ec87dab8ba4b71b9103e07834a2c02637de0589bd1aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385711, "uuid": "68a64032-4d84-4226-8773-61134714220c", "value": "T10115233221252C9CC723C57381B24BB560B2EF1151617A736BC0F6366C69D286F3BEE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385711, "uuid": "7d04a974-5011-442c-81be-3108b41f240f", "value": "1eb8b9beb0139afdc180cdb9196a6b49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385711, "uuid": "0458959b-283b-4caa-8a39-e78b80504c98", "value": "24576:JT9r/e2goEAxS0VGzwYKvIxDwxqUVKYCSt9X7:JTZ/e2zEWGzwYKwJMDCSf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786385711, "uuid": "c98dfb79-6322-46fa-a6b5-51048a797240", "value": 932352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786385711, "uuid": "d2b7d6e8-e6fb-47b4-a236-31a80bda23a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385711, "uuid": "64bc5074-2fd4-40ba-9ac4-1b615a42c92d", "value": "03b6ed7086933a7082905360bd9803d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d10e72-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786373005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373005, "uuid": "28b9f6cc-0ab5-43f9-b8a2-5d8fc5cdc55f", "comment": "Malware payload (PhantomStealer)", "value": "fc2d8dad7482a6779f49e6e7c499164a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373005, "uuid": "64091260-419c-4d29-90c9-25e7079e72a7", "comment": "Malware payload (PhantomStealer)", "value": "272cadb67ea6d46e4f4e9219ee8fc8449fc6e2c2cf2ca4cf4303f02c9f00b21c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373005, "uuid": "1515d4cc-41f9-4ca6-9cdb-3a9d47c74f99", "comment": "Malware payload (PhantomStealer)", "value": "bed4b6425baf7b6f9b896be8b5ce45092c083086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373005, "uuid": "fcbc9dcf-faed-4429-9fa7-5205f7d73c66", "comment": "Malware payload (PhantomStealer)", "value": "1847b3699a5a1b187248c73ba1bf3b780d4157b5dd8ac89f48c3b5d20a9de0d23db3a2af1406bf684d98de5975aa0420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373005, "uuid": "31585461-01a1-4d70-9e31-4d7045a4defe", "value": "T1D645F150225BD842D0E687B3A8F0D37422650ECE78E3C29B9EE56FF735153C695A8782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373005, "uuid": "64d50a24-1e0a-4eaa-afe0-6fff3704d531", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373005, "uuid": "04c355de-eccd-417f-afed-8a072f01e371", "value": "24576:Wlp50BpDQY3DLFTiKwkIU6yC3DJ97s0G+Aw56cSq8pqrD:epUtDLxi26yC3D/w0H2TpqrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373005, "uuid": "2eaf78f5-bf18-4cb4-a2d8-f4ecac33e0d4", "value": 1241600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373005, "uuid": "04f70952-5e4f-4863-a6e9-662e8cd7e43f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373005, "uuid": "b338aa10-dcb1-4adc-a8ea-d31d43199124", "value": "272cadb67ea6d46e4f4e9219ee8fc8449fc6e2c2cf2ca4cf4303f02c9f00b21c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319a92ac-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786371008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371008, "uuid": "424d1b55-e69a-4925-8cd5-23ca614b1bcf", "comment": "Malware payload (RemcosRAT)", "value": "20476f3a51dfddf3dc0603fc7858d894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371008, "uuid": "87d93c4b-b8d8-4e3d-b0b9-a4999c421509", "comment": "Malware payload (RemcosRAT)", "value": "279e14ad7bad135f7b63e17c355c969116c2db600967061bbab107f66d62dbb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371008, "uuid": "f0e707f4-4ec7-4db3-834c-be1465784c23", "comment": "Malware payload (RemcosRAT)", "value": "8473528eae1e7cfaae6099b45260b9c576275bbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371008, "uuid": "28c263e2-425d-43e5-9a40-bc59af039816", "comment": "Malware payload (RemcosRAT)", "value": "5f3ebe179a246d8b407d82f3d2ecd69a06effae17a1510c151e4d5571f3a9290193516650dd1370cb601838dea64fcbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371008, "uuid": "5ff8fe6f-b153-4d3e-9138-4e3994e08937", "value": "T1DD0512507A4ACD12E5D31FB148B0F37916707E5DE600CA0B8AFDBFDB782AB4AB809551", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371008, "uuid": "b94f472c-ca15-4d96-899b-9cd2ce4e141b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371008, "uuid": "df8a8a4d-3605-4cc3-902d-aa7bc0f75f24", "value": "12288:c3ZIaopA+Vuvmwt715Qm+b9ggacQ2qCAm4n1K+n4n3SfozoOyzgN:cpIaopFK9oT9gg2nCAm4n1L4nCfozgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371008, "uuid": "720f7bea-ec16-4c00-8be8-a019f6acbba7", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371008, "uuid": "ae719284-8388-4388-ab4c-603f0f826285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371008, "uuid": "8c070f42-38b2-41c5-885c-7dcea1b33910", "value": "279e14ad7bad135f7b63e17c355c969116c2db600967061bbab107f66d62dbb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41f4c51-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1786368677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368677, "uuid": "c11f19cd-f61c-4a37-bbcc-8794aa91420d", "comment": "Malware payload (DarkTortilla)", "value": "d4a282502964d2de15b2510adcaaf33e", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368677, "uuid": "3210025f-2d32-4738-8700-b1e9b8c34d20", "comment": "Malware payload (DarkTortilla)", "value": "27be960b02569dca8559acbb4fc8160ecea649123c7addfece87f09ff93fb2be", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368677, "uuid": "a837628d-2d8e-4b13-b148-268b30548de3", "comment": "Malware payload (DarkTortilla)", "value": "99a8bec19f2548972a7198b3ee687a0c04a8c834", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368677, "uuid": "2aaf32a5-579c-47ad-b768-61e70c2656f2", "comment": "Malware payload (DarkTortilla)", "value": "06c1121a673c9ec41f502f582923145b7400049aa35c4e75880d04f939d605c13a12c83507c4593716b2a773eda67a1f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368677, "uuid": "0fdaad92-e1df-4f0f-a02f-03e184883d9b", "value": "T19385F11A5CC326D1D5BE4FB4D3A514E863F095178285E7AB6EF802F4CE92B8BD907063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368677, "uuid": "56237e34-9289-42eb-a13a-efd7a2e6f7a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368677, "uuid": "7bef60eb-3c81-4499-8fce-60ddf3e09468", "value": "24576:V0/vylA83Tge0F7UHx59pVXHEhWKSv5on2kfzwTrEekuEKPhZQLOHM:2/vyepFS9VXEhSv5oAPGeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368677, "uuid": "acb2ff0d-3b7d-49fc-bcf2-12cf002c381d", "value": 1768448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368677, "uuid": "299c1273-cbdf-48b0-8b8c-43d85ff088fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368677, "uuid": "ddd0d071-6064-44f4-be5f-8a566a77f719", "value": "27be960b02569dca8559acbb4fc8160ecea649123c7addfece87f09ff93fb2be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49dded0-9466-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786330426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330426, "uuid": "c999f57f-f870-4a37-923d-5d3ccfa6c3ed", "comment": "Malware payload", "value": "e518ee98976ffa1d837a556a6e4ad461", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330426, "uuid": "caf64942-4b83-4eed-b75a-35d5fd0b8545", "comment": "Malware payload", "value": "27c7428f9e61eb9b21251cb0d9e8f5c2ea7fa41091a174158581ba577c3f1f74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330426, "uuid": "d33d363f-0ac3-4885-826c-34467e7b04be", "comment": "Malware payload", "value": "150a09769fb4cee6aecf3e4e89c0e2f4087bc9cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330426, "uuid": "a58aadd9-7532-4c75-8950-ea227951491f", "comment": "Malware payload", "value": "c74f72ed5dd8600107e06b0cf2ec1a34d94e3036bdd530bafc08e6999a5ac25bd08b7cc79ab3527c77754015be78db94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330426, "uuid": "084c7a11-580d-4c59-9d65-23a737d58720", "value": "T18A233B46FD268720D3A216F05FF55A4257506E6638D33300DCA8F73CA9AD0A86793EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330426, "uuid": "949032e7-7f9a-40e9-b1d3-2c6de8cf5159", "value": "768:jfWK9VnF5P9HrABmvYhuTBwBpbXSQS9rg2+5alXjtrsvQXM/lTnYuH6yzhxw0Zng:CK9tPOm143oqmMtTnXZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786330426, "uuid": "c258b9bd-c21c-4a22-b61d-bf677812023f", "value": 45948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786330426, "uuid": "0784b648-266e-43f4-b881-bc68dec2da55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330426, "uuid": "84f75079-d8b4-44f1-b7b1-cdc908c6d8fb", "value": "main.riscv32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c43a5fb-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786372449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372449, "uuid": "9c1ab418-f491-4c29-95b7-bf875664e151", "comment": "Malware payload (PhantomStealer)", "value": "b8f5f0809d710a63915948e4734026ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372449, "uuid": "e8378e26-bd4f-4f61-94a2-46262b901e4a", "comment": "Malware payload (PhantomStealer)", "value": "27c7afa7d8d8a164b08778b419118dadc8fed4962d0fada69f5883a266df8444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372449, "uuid": "b7b8594d-7288-4541-802b-64e93aec7bf1", "comment": "Malware payload (PhantomStealer)", "value": "4353aa814e998df4c6cdf59aebc5efce9d7c57bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372449, "uuid": "c36bc149-dadb-4444-bf3a-9b7aacd8859d", "comment": "Malware payload (PhantomStealer)", "value": "4cf5857575c3f3d74fddead7c775dc086a67ecc0e024f5ab0182f59edc9525b41fe853ab742456557a8ce2223e330a46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372449, "uuid": "74cb108d-dd1d-40d3-9238-151177596b54", "value": "T1E6451255E7EBCE15C27447B048E4D17003B16E4DE422D5870EE9ACCB7A22B9B4EC8B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372449, "uuid": "2bf08284-9b68-4769-81d8-442773c96dbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372449, "uuid": "55268a4a-910f-4482-b469-514c5514003b", "value": "24576:xjsj/Og3p1v/V5H0Q1FmvnvxS4p8kfj9xMbGxCFQEd/B/0ZkM18pH:52PjV5UOIQAH5xMECF1d/10Zkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372449, "uuid": "78c6e716-7f12-4472-ae4a-06a484e5296a", "value": 1192960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372449, "uuid": "d5f4a060-96be-4f33-9f62-becd9441aa77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372449, "uuid": "7bffa951-c6f2-482a-aa39-17a305be3aa8", "value": "27c7afa7d8d8a164b08778b419118dadc8fed4962d0fada69f5883a266df8444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a6d4a3-946f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786334323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334323, "uuid": "e3985332-81d7-453e-bcf3-0b5b4ef7949e", "comment": "Malware payload", "value": "f0ffb9a35887284e4f2a1b6176e706d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334323, "uuid": "33dda916-af46-4eba-9785-62d9783a83f5", "comment": "Malware payload", "value": "27e13c5fbb4a1193189eab2ad5e9733a80c69a4543c095c8e51dee8caf900e23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334323, "uuid": "3373e198-26b7-4544-a085-5905efd39466", "comment": "Malware payload", "value": "57b96817f20e4d8106dc20eb9c4514cb3db7eb11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334323, "uuid": "83debfe6-ead1-4aae-8110-eba6aa893e46", "comment": "Malware payload", "value": "f8131eb845871a561f883b4a0b1301b883983e05de39c2bfaaf789d6692ab21357351c889fde2f7384d23103cbdda04e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334323, "uuid": "606c349c-3ff7-4a68-84a5-d1de6162e01c", "value": "T13E63FA06EE916AF7C01ECE70952DC24A01D65CBE92EA511E71F8C98C7FBD3564AD3C88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334323, "uuid": "86606097-aacd-497e-8847-b4c89faa2057", "value": "768:li2MzqiR0r2tnXPjXHdAs5Z6trX5iMqul9GdPmQ+NjO4SlU1hduc:kR06tnXb5ctz5iMtluY/7sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786334323, "uuid": "e26bb43b-7971-4202-b03a-48b45e9686f6", "value": 72960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786334323, "uuid": "149e8486-7df2-474c-a3e4-a22ddff5a421", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334323, "uuid": "eeaadf1c-92f9-421b-8fc3-dbadc5f8d204", "value": "27e13c5fbb4a1193189eab2ad5e9733a80c69a4543c095c8e51dee8caf900e23.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e18097-949d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786353827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353827, "uuid": "49fce97e-ea32-4e1a-8132-5721a8610fe2", "comment": "Malware payload (Mirai)", "value": "672efd85f0b144c662941a62f14328d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353827, "uuid": "e576df79-4c98-4c1f-9cfa-97f0ffc98a71", "comment": "Malware payload (Mirai)", "value": "280ece3234a3dfd3fd033df71d11afcbc08109164f36b8acb6afe8b03b81c1d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353827, "uuid": "4bb817af-bebe-4e5a-bff4-b2335bb22694", "comment": "Malware payload (Mirai)", "value": "28818f0451f9dd61762e60f06212f26e58a88f44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353827, "uuid": "22ae2fb1-e5e6-45c5-b974-90ad56962b61", "comment": "Malware payload (Mirai)", "value": "da0f5e1250aecac028a4ca17cf1de3071288885f5e4006cd28c782947b87a429ca6bffd4a10b5c55e5ed89d899441d8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353827, "uuid": "fc07d616-8190-49e0-8354-a224f39ae337", "value": "T1E9F34B07A8655FA7C589AEB566F75A340753E8110B4F0F8AB23AEAF406079DCF40E374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353827, "uuid": "dd4f91e7-787a-4828-bace-bc83681ad132", "value": "3072:K7CL9hXpdAnqsTZ6UO2s90WRhGcIC0AzIC/L+5vCBv75xXBT2aLf5FwD:KWZlpdAnqsTZ7OXtRhdzdICDmvCBv75Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353827, "uuid": "b7bddda0-79f6-4f8a-8b48-3edcd6bd475a", "value": 163019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353827, "uuid": "0875572c-323e-4925-a2f7-7f672f3b76da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353827, "uuid": "65f32b55-0dc7-422f-a5f0-fa1363ade5ec", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4aa7d00-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371282, "uuid": "a698c859-2876-4e47-b178-a33f5467a189", "comment": "Malware payload (Vidar)", "value": "ab62b4aa0594fc562bb9a009fe6f4d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371282, "uuid": "0246c100-780c-4a0c-ba30-66e0017fd55e", "comment": "Malware payload (Vidar)", "value": "28102ff5a36c9686d643f98376acbc4f322faf61dae44c72b6970fec4bb31f7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371282, "uuid": "a0cb9ae4-fa2b-448a-8209-def3e6fc2593", "comment": "Malware payload (Vidar)", "value": "020d3ca87aeea500f95e6e3b63b98a2a52d86367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371282, "uuid": "7a4ad62b-ac10-4f61-b139-39372623cf05", "comment": "Malware payload (Vidar)", "value": "98bbf017b50e37971319f26fe177f3f6393454c5e86e34b2cfb7d624c568c444bd412c75a90784bf06cb5413dadd221a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371282, "uuid": "72e1af5b-15cd-4e04-b6b9-383b23eb1149", "value": "T13D520BC774C320F9D0F88378C94F5ABA8A267095271E9EFF46DDC51432E2A511ABCE60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371282, "uuid": "4da3c73f-cc3b-4791-8ba3-76bed190524e", "value": "e489cd9c73beee1db4c320380f37924e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371282, "uuid": "5f1ef35d-7bfe-4a4b-8e80-f26fb9486ef6", "value": "192:OZ4X2Q5tDt49Ewnhe8soCk9wTAl8o8V2/bt1xxd167B3Vd:OanJ4CwnhVsoPCmdn1xxoBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371282, "uuid": "b8cbc749-f4f3-48c5-aeea-3f25f96982cc", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371282, "uuid": "b96d59c5-5fbd-4631-88ae-9b862a916dc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371282, "uuid": "c843c1ec-e353-4368-9a3c-e3b284505554", "value": "28102ff5a36c9686d643f98376acbc4f322faf61dae44c72b6970fec4bb31f7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3460cdb-94d7-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786379064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786379064, "uuid": "030e6b0e-16ff-4866-9feb-ed82bc6fc24c", "comment": "Malware payload (PhantomStealer)", "value": "608d29acfe6b1fed236edee902f69c87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786379064, "uuid": "642f7351-f405-4ca7-b6a0-2b4611a8abbc", "comment": "Malware payload (PhantomStealer)", "value": "283457427a1f20a6a9807220f489910f9e5130aeab73aac82df07f1c690651cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786379064, "uuid": "6a10e16e-61f2-42eb-877c-ff37d2464057", "comment": "Malware payload (PhantomStealer)", "value": "4d13d393f6569eec20053d2e3512552c8d3e8287", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786379064, "uuid": "2cf934e1-53c5-465b-b394-a541724cdde4", "comment": "Malware payload (PhantomStealer)", "value": "e3fe08b3c9233874fcc66a177c8d5290b3657a03ed919ac2d60a8629f199cfb31da0896dc247dc1322cb995beb77dccb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786379064, "uuid": "364f9b28-f811-4dd9-bc42-cda489bd7a5a", "value": "T1A606D64127449D72B72DAB5CD13ADAF09A5A611314C5DF1E30ACF2087B6CD0BA79CEE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786379064, "uuid": "c862aab8-83f8-461d-b6b3-8432bd4c0cda", "value": "98304:McrcxAxkORiADeM3u5gvb3tzyzD1bJ0E8S31Shtmp8+dTWhCfoMObgszXqzD:DriEeEuub9zeDlR8S31SHmp8+9cCuzX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786379064, "uuid": "4d20795e-6eb8-4f1c-b528-519a54ffaedd", "value": 3664134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786379064, "uuid": "55745f80-0506-4668-9dab-26a4d5937509", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786379064, "uuid": "73846cff-f5df-4537-9a54-5ce85bd1f90a", "value": "STATEMENT OF ACCOUNT_CSCBOS 202607.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf7bc58-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371564, "uuid": "4ddb1660-f948-4e6d-8f89-6a6f169334c7", "comment": "Malware payload (Formbook)", "value": "af4e455993cd83b4832fc452a9955cab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371564, "uuid": "d70ba306-eba1-4fe1-8077-f97aba8c2395", "comment": "Malware payload (Formbook)", "value": "284040a981976a9b34622bbe6d0c05a4a1da103e002a8268750d966847c47912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371564, "uuid": "d2bbb074-6ba7-4341-ace2-f579b9bf24a9", "comment": "Malware payload (Formbook)", "value": "2055d784a098cdcd1daa22c03f902ac17a2c95f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371564, "uuid": "c0a289d2-5353-4fb5-9b98-a5b0ab0ae5e8", "comment": "Malware payload (Formbook)", "value": "6d47777584ca413f59e2ef4d562b751626beebece2fd2ca8ccb5e48c67631f54e3cf7d37b15030f62bdca4817afb4537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371564, "uuid": "6dcb3d37-26bb-4d8a-b53b-ae715e4b28ba", "value": "T1772522282208C607C89627B90AA4F27C13BD1EDA6422D3376FDDBDEFB932F555C51192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371564, "uuid": "81b0ed9a-8775-4c6c-b529-8ff8c8e4b275", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371564, "uuid": "0346bbb2-17e3-49b7-b88a-e83a49dee189", "value": "24576:Kbz6pm7gqkW3NDrtFbkTklgbudqfVrVSjxpYVx:DM7b9JFbkTkYV9rVSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371564, "uuid": "6d4de8cb-705b-4c12-9702-9a8a2cabe17c", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371564, "uuid": "c8061118-0554-492e-b93d-3416fed522e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371564, "uuid": "2c7e9fdb-51b6-42c8-94e2-425548d831d7", "value": "284040a981976a9b34622bbe6d0c05a4a1da103e002a8268750d966847c47912", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13cf5644-9463-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786328868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328868, "uuid": "4c5619bf-62bf-4ae0-a342-e91ca9e35ed0", "comment": "Malware payload", "value": "9a080c35fae733726bd422c55f81e7e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328868, "uuid": "5caea1fa-d587-495e-9b79-bac789a17f2b", "comment": "Malware payload", "value": "28453e3796ae864a07efceb26f881c2d3d05bcdb95012b817e8dfe9fdc5eee34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328868, "uuid": "b66df956-06f2-4eee-b79c-dd74edbd66a7", "comment": "Malware payload", "value": "63ef4fa804d8920c01e2588bb26bd765e648ea69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328868, "uuid": "01fd84e7-b9ff-48d8-b98f-0a87c1bc7879", "comment": "Malware payload", "value": "69f12d6b1245bb9c9be093469b89827a44e399b4c6f8bd260e944b363dfb69b0a8922bf21bb4a6671831080843b63c84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328868, "uuid": "edd6b615-1761-4544-a8f0-5c7632e44fdb", "value": "T11E631A7A7711AFA9C26CD53009F28BE58AF21A6325E280817374DB0CAE7151C2C9FDF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328868, "uuid": "df214ece-77a0-4ab9-8bbc-c0255e0b6d05", "value": "1536:pidZZug3zU+xUBMZraMGqK5QiXEzEnkApGz2cs85eWNfFKEV+jOPf:MkAz2x85eWNTVi6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328868, "uuid": "a7204251-a550-40f6-99ea-43767d9bbfed", "value": 72960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328868, "uuid": "bfcf609e-892e-4a74-b4a0-fb4808747512", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328868, "uuid": "52dcbdae-647b-4b32-87ba-24efe5f559da", "value": "main.mips32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf751b5-9501-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786397010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397010, "uuid": "5d0c2c9f-0599-4421-8a96-9c22fb140d7f", "comment": "Malware payload", "value": "bb1ea7517e2dde8f1db1d989d47eee57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397010, "uuid": "ccd619f7-c34a-457f-8fad-79fbf12dbbda", "comment": "Malware payload", "value": "28b4d64ca9b0fddad1e87ef8d31a0b79803e34d26b53eeab205b851ab4f1c391", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397010, "uuid": "68b5bb66-8f85-448d-8b38-91f3d3ffad6e", "comment": "Malware payload", "value": "e5d6a6a2e6113f8c846281cc2a0d7fdf07102ad4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397010, "uuid": "0ddca02b-d781-44e2-83ea-818c64d5f89e", "comment": "Malware payload", "value": "3d8b4274dc120393a5bd5ff071538554de286d4f1cc97c0ccfe0b7e8e86a40f668c0afe9abaa57e5cf55f43fe1c9698d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397010, "uuid": "e5472763-798c-4f83-bbf6-92d7f0b2a7a2", "value": "T1FC53081BB5E3B0BCC297D0745A5AD9B2B9317CA002213E7F97C8FA312E35E016759A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397010, "uuid": "851647e3-2d46-4f13-adac-eab248492a27", "value": "1536:sy2ocWz/ZrJmc7G0kOxok/ZOQeh37ygor6kNzeUr:sy2gpJmcy9Oeh+rF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786397010, "uuid": "7d73b85a-f832-4e51-b4c1-8226f661e3f2", "value": 66640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786397010, "uuid": "4e4610e4-1538-4cff-8b88-6dfe65ee2cfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397010, "uuid": "09f19f03-aca0-4491-aefe-77497e43b2b8", "value": "main.x86-64-v4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344deadf-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356839, "uuid": "9f819eb1-723c-47d4-a734-dd3a8f00cb69", "comment": "Malware payload (Mirai)", "value": "d0bb355df43c596493f9b735542c95e6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356839, "uuid": "b2cd196a-5c36-4479-a6cc-e63d2a192cd8", "comment": "Malware payload (Mirai)", "value": "28cfb803149a83d652ebdcc5303b4c0fe9a7bf14e083488e0f9e2808b08d470e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356839, "uuid": "0b596d8d-0937-41b3-a124-a9e2b16f528f", "comment": "Malware payload (Mirai)", "value": "6b20f45fc0c70043c2052b6ae1bfbfa395136b96", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356839, "uuid": "413c662f-883d-496d-bed6-5ce163349ca0", "comment": "Malware payload (Mirai)", "value": "f61961b4925395b5f4d3bdadfc195d35ee6b21200d83d15dc1c14116cafbe656063f81d3a12e19ee49bc77d7f686955b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356839, "uuid": "84d1363a-799c-485f-96d9-17667b9787ac", "value": "T1A6144A02732D0D07D1A32EB0373F27E193EF999221E4B545299EAF9E8075E325945ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356839, "uuid": "39cdc8e9-18ea-4bdd-901e-ef1acf530165", "value": "3072:ktpa1/GKvNsngJ0L6H21zRuWqjDPkxpY76LPCgWiU2i1wdn:Mpa1eKv+gJk6MRREkxpY76r2iViqdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356839, "uuid": "0bb7e14b-6901-4736-9cee-c76a795f70fb", "value": 200816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356839, "uuid": "a2f4b520-5533-464d-903e-ada5573f95ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356839, "uuid": "4cfe1502-2944-4431-a954-43c57a952fa0", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0a0528-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786345763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345763, "uuid": "fa221763-84b0-4332-84cc-6a16fe4acab6", "comment": "Malware payload", "value": "f1a0e92f416b0661e414686540b6659b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345763, "uuid": "bc8a4141-9350-449d-a6fb-f89b295119ad", "comment": "Malware payload", "value": "2956dd88242e6d0ca3c2e3d6337870c766519a5a0a30ca563dc74c1cb5d2cbf2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345763, "uuid": "d4de250a-223a-4021-a6d6-ea154b0bc2dc", "comment": "Malware payload", "value": "50e0b1e430a38a2a9d1768f0f2029b33a50138c3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345763, "uuid": "9562f082-a3ae-46ad-b745-fb90d079d1f1", "comment": "Malware payload", "value": "30b5915af3a749d320e41c0d2f987e89ae3d25cc70eada41f99ce176eb7a7eef0deb63fdbce6b115e45ab0ca07834226", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345763, "uuid": "d7add566-7f63-4beb-bf21-95f2d17033a0", "value": "T1B9236D651A857C24AA98C4371D7E2F0CBDAD43E6324492EE7FCA3CF28C5A69DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345763, "uuid": "8f88b041-7875-43dd-962e-0d4f22b19db7", "value": "768:pXRWNGxVP9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:jlxWcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345763, "uuid": "30d2fe6d-a9a0-46b1-a33d-ba0a6a7d55f9", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345763, "uuid": "2c035a6c-2b4e-478e-9166-0a8ce7fb2e4e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345763, "uuid": "1e7e4713-31f7-471c-988f-5d7a306479fe", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99abd112-9472-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786335535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335535, "uuid": "f92b5250-b123-4469-a1fe-8934f11d3b4b", "comment": "Malware payload", "value": "d9faeabbeaf8cf5490937492543a7333", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335535, "uuid": "c26f97c2-0985-4683-9050-482071f32970", "comment": "Malware payload", "value": "296a6b701c26c5eb323efdf168f54d6125a522015882d407636b0bf7a26f8533", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335535, "uuid": "1c564ab5-b230-4316-9b5b-388a837e6bac", "comment": "Malware payload", "value": "8c27ec074cbf17bf03065b9db922969eafe35410", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335535, "uuid": "485e29de-4324-4ad3-9c74-b9522641f7e7", "comment": "Malware payload", "value": "877573a843a2644963c30755045b57497f69e526e5bedea3a81c7906be2b08bd638bd6916eb7ce12737af8017f916268", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335535, "uuid": "ec29b5b5-fb26-43a2-8010-59ccc6de2f7e", "value": "T11C23D417B6A3B0BCC34BD1744AABD5F1B8317CA402213E3F97C9FA312E359116A59A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335535, "uuid": "b944ac57-afbb-4fb4-85bb-69cb36119106", "value": "768:RMyc5MFaiMn+m1D9UDx1BeMHScRVZp4tPQuLn/ITljMJ:iyc5MFaJJ6nB7ycbZp4tP5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786335535, "uuid": "7b26c292-b3eb-4659-aeb5-589af78e0358", "value": 46160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786335535, "uuid": "b1a9e376-d9cf-44de-a26e-1e9e30aec2a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335535, "uuid": "79c2431f-50dc-4440-a19f-6f4c4769f8d0", "value": "296a6b701c26c5eb323efdf168f54d6125a522015882d407636b0bf7a26f8533.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9db499-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786371622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371622, "uuid": "a57541b3-7b40-4e06-9e4c-baa2ce03f48c", "comment": "Malware payload (AsyncRAT)", "value": "bdd71bb539dcddf10bfccf3e1449dac4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371622, "uuid": "c79d3352-4aae-45be-8961-76d08862b61f", "comment": "Malware payload (AsyncRAT)", "value": "29bdae0aa26b6ed72a2ce493fcb07b1464ee00fc3dd88f2f07f47c63aa8e0113", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371622, "uuid": "c16b5f7f-cf25-49cd-b1fa-01e8535fc8de", "comment": "Malware payload (AsyncRAT)", "value": "f53acb5395637e6d8383a54967e4d8809ee1206a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371622, "uuid": "a8381ed4-d761-4d6a-a4f1-88ed8cde6f95", "comment": "Malware payload (AsyncRAT)", "value": "e3270480f5fec00a6e33278a491156168bb6e3fb9a559ae56e724e0de3af184de9df1901b2a14933773ba92ea345aa9d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371622, "uuid": "7c5d3758-4ccd-49e3-8beb-a3b74f519ae7", "value": "T1A1F4129C6649EE0BCA5523B50A61F1B513AE1CEAB820D763AFDD7EDF7923E044C040D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371622, "uuid": "09891264-9d38-4e8e-82ad-d5d6c13a1554", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371622, "uuid": "2d8acaca-c805-4011-ae9b-e1cd97013144", "value": "12288:olJdbk0ItSS+Okqh4vKbEKkffz5YWAVu4PNHwBKkiDrDHyYS:o630kJEjfz9guZ2DHSYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371622, "uuid": "0916ab3f-5e3f-4591-b9b7-cc5773f112f2", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371622, "uuid": "9d68bbe0-3f11-4411-830a-4b842059dabc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371622, "uuid": "5e723b19-1977-4b95-a9f4-727fd66a803e", "value": "29bdae0aa26b6ed72a2ce493fcb07b1464ee00fc3dd88f2f07f47c63aa8e0113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1923e605-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369249, "uuid": "27b0ab9b-cd30-44fb-bdc7-db96fb7f0e9f", "comment": "Malware payload (Vidar)", "value": "6126a7bba9377499185ef39649b65652", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369249, "uuid": "75389636-82ff-4166-bbc0-330b2a13878b", "comment": "Malware payload (Vidar)", "value": "2a014bc6af2e26c3ebdfe74e105f65c09f6edc818e0e7610f5b1d25774090437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369249, "uuid": "e0759f45-3d7d-43d3-9717-1454e97938a2", "comment": "Malware payload (Vidar)", "value": "e9ef6d8bac501c5201b10252e5ad57b79e3218d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369249, "uuid": "addd06dc-474b-4735-997e-f79eadfefff5", "comment": "Malware payload (Vidar)", "value": "de942ef036ee584b981738872d5391b7c1260256682f9f2c2c925cb78b32cad838bbeacd91d75cfc631aa6e1371208df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369249, "uuid": "a2e19dc3-56c8-4716-9327-9e86d148649d", "value": "T12A520AC77392A2BDC06883BCC69E22E7DB24309417169EFFA2DCC58457C25407678F65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369249, "uuid": "f35bb9d5-e0db-4a92-b76d-f0ab1b9e6745", "value": "6dc49e85762e4ee01dd5464c00241541", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369249, "uuid": "02483f86-e415-4362-9973-85f2a6076157", "value": "192:Oih/xokuHUGrSGMzn/vgsc1Y7MKXwuR2EovjQaoli4CCVF053VOjl:Oih/+TDGGe/Isc1Y7b4BvjQ19CvlOjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369249, "uuid": "f54032de-ff36-469d-8020-90ba101ffaf5", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369249, "uuid": "5158843a-6783-4431-92a9-2f38a1646895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369249, "uuid": "a47a3671-657e-4f58-849d-c6da8d18723d", "value": "2a014bc6af2e26c3ebdfe74e105f65c09f6edc818e0e7610f5b1d25774090437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf07890-9494-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1786350168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350168, "uuid": "ea918e5f-8ce1-4d7c-98d4-45917f0edef1", "comment": "Malware payload (PureRAT)", "value": "325dd213f9a6f78e41cad30c49e0a178", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350168, "uuid": "ef339b0c-275e-418c-a5ff-1ba7ed7877c0", "comment": "Malware payload (PureRAT)", "value": "2a167fbe58a9d874dda8798e9b0d773d9316a217256a7e3f1d0c5e3e26f9f03a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350168, "uuid": "5d98bb96-9732-4357-9256-7672600ef33a", "comment": "Malware payload (PureRAT)", "value": "666974fd5ab2ab200c8c87e1945708c9e4f2e76e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350168, "uuid": "2291ad98-755d-4938-bff7-d035053bd04d", "comment": "Malware payload (PureRAT)", "value": "4dd3fbf117799092a054f0d8031d970f8940e7a90ab64dd8ed0df50993f1503653bc5eeb52c21792bec9b6ecb19a1219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350168, "uuid": "8745e6d7-1782-4277-8282-93407fc59ee1", "value": "T186649D5823ED8A26E6FD63B5E83D040D47FAB51A612EFB4F1AA010FD5C13B8489017B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350168, "uuid": "2f10cf10-03f9-4730-bc47-d88a733c54ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350168, "uuid": "be26bfbc-f146-4725-a32a-1e582e491375", "value": "6144:C1w1LLUxBwarTXCcHTGVMLxu+H6DGWESIt+z8WC3iH:C6Pu3TCIyESY+z8WHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786350168, "uuid": "da0b68ad-cd67-4240-abff-d95621cbf382", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786350168, "uuid": "d69aa87f-3c0c-4a71-9094-ad7d6eb73629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350168, "uuid": "b4d1dcef-8089-40f3-9ca2-eebd2cf4f850", "value": "325dd213f9a6f78e41cad30c49e0a178.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0ef474-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368799, "uuid": "ab042b26-56ef-47b1-93c4-d77d2559709b", "comment": "Malware payload (Formbook)", "value": "bb5d228a6918a16e275839a7eaf2a58c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368799, "uuid": "f923a58d-5863-4f9d-8b7f-94dc0a4ce5de", "comment": "Malware payload (Formbook)", "value": "2a18b3492f1ba54315d620ce3e8be895a22f220f7f4d6d2c248327351adfe2fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368799, "uuid": "f8bb419e-167f-4c40-bd4f-fc4dfc5d0825", "comment": "Malware payload (Formbook)", "value": "8ddabb59af4aec311cb823df80a612d01e233bfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368799, "uuid": "8c404a4f-a81f-4077-8677-b94a92df8894", "comment": "Malware payload (Formbook)", "value": "c7079a47605db2a107d3e6b1617880e95167ce42314bf522281170bd32b0ff73b848c4be881333eafd6cf6500bb41ea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368799, "uuid": "752cc10b-6207-4a2c-95f1-bd84f39de1bf", "value": "T18B252228579DD112CAC687741E75F33106BA7E5CB020D32A8FECBD9B3A33B026654796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368799, "uuid": "416236be-d667-4647-bda3-74887e4b129b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368799, "uuid": "a9cdb3cf-212f-4285-a93c-6ad8f10d4406", "value": "24576:bX9Q4jERuqzprrl253vw7PjBoVx2G7B41gGZ9Ab7AV7:btQ4jo5MIjeL2qqtwHAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368799, "uuid": "0651bd61-eb15-493f-bb86-472c3a8a9001", "value": 999936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368799, "uuid": "a4728182-a7b1-4c06-8c5e-ec9f843311ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368799, "uuid": "5bcefe19-6275-4a4d-beb6-3dcd7a03d8eb", "value": "2a18b3492f1ba54315d620ce3e8be895a22f220f7f4d6d2c248327351adfe2fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3e4e1a-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786371514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371514, "uuid": "378229e7-cb58-4b06-8f1d-0aad964bcfd3", "comment": "Malware payload (PureLogsStealer)", "value": "4e103369276ff0b62a8ec99bd95dfd69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371514, "uuid": "f200f802-91b3-40d4-beb5-040d6cd9f4aa", "comment": "Malware payload (PureLogsStealer)", "value": "2a813347072c501f5654cd0ae0e0330c52d9ecf44d753ece6a81410c3829c63a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371514, "uuid": "8a453c5c-4166-41f8-b470-d06688988899", "comment": "Malware payload (PureLogsStealer)", "value": "a8d5d0882d133721430c6e437b1222b40fe7aa4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371514, "uuid": "ddf1ee11-2d94-4941-aaf0-4a0a2c6c5ec2", "comment": "Malware payload (PureLogsStealer)", "value": "ac6e94d38d3b6704733a7eaee0df3b07a41437feef80444799820948ce6988d5878d28641abd13bfda56570862213cc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371514, "uuid": "03b6acb3-cd8e-4174-a3bb-8d46e37bb025", "value": "T15385D01DF38D12E8D227C234CBA26232E3B578550765BADB069AD6152FB39D02F7B311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371514, "uuid": "fe4b1b1a-4413-4bb5-868f-3fd58db4f25e", "value": "f765367f0a88e2dcf14edcaad7ab658b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371514, "uuid": "083e1f5b-909e-4564-89ab-a513df359895", "value": "49152:2S9ZGKd9rfG8GcW2wdgVSSnfYQrGnHZpBt74jOkLy:9GMTcYGHZHdIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371514, "uuid": "b29f888b-3a5d-4b3c-84c5-f7010bb3846a", "value": 1796096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371514, "uuid": "211753b7-c6a2-4bf2-93b4-5926de80e926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371514, "uuid": "cd03d5f5-6c9e-4d9a-a21a-eb50ef15b9d4", "value": "2a813347072c501f5654cd0ae0e0330c52d9ecf44d753ece6a81410c3829c63a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822fc00d-94fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395625, "uuid": "c02cc20f-6b3c-4678-b2c1-b27944196bc3", "comment": "Malware payload", "value": "eb099adfc66b6aeff93cf22c22d5c3f8", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395625, "uuid": "3a4b16a9-73f1-4845-b353-04c9a1dc647d", "comment": "Malware payload", "value": "2b27254fc815f9d286a531433e62f8735cf8fce15b90a73505a85c68aafe4da5", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395625, "uuid": "00e2839d-5cbf-44d7-9181-345aced23754", "comment": "Malware payload", "value": "2c993f11067eacfa11fb115b6b7b2d16d47e73d3", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395625, "uuid": "ae367acb-1418-4a3c-86cf-6c5c076109e5", "comment": "Malware payload", "value": "374df1383fda91f756b1f0798d94c962a91adfb6c544b5db12151c1b008e092b400faa07ce87f528ce2fb3294aa4b9d1", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395625, "uuid": "e8553447-5d9e-411b-8cd2-fb16e25a9614", "value": "T18232F6CCAF9062F4F29303DD27AF2999136561CB504CD880F68C6DE06F4B68D4A86E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395625, "uuid": "f1a43e92-1a21-45ed-bb09-955b6a104710", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxz/lX42AiYOpzfMUJtl9CX:sXX+/DV7k/3/lLAiYOpzEy9CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395625, "uuid": "8794a6db-2f3c-492b-b8c1-12f8ede3448f", "value": 11947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395625, "uuid": "a707b8ad-5beb-4a60-80e5-873e2f819c1d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395625, "uuid": "236d406d-314c-493a-bb0d-e635e6ab2f53", "value": "felixReport.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565e72f1-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369352, "uuid": "ea11d060-fa57-4e24-93f6-087422ac9a2b", "comment": "Malware payload (Vidar)", "value": "6d825e642f19ccf3a3ec8beabbd0b664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369352, "uuid": "99015e9e-8294-4190-b9f4-b84b2eb67ad6", "comment": "Malware payload (Vidar)", "value": "2b4345020809f679e81374554f2e887d3b8f88dcb0fcd1ea4758305049843eb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369352, "uuid": "b02bf34f-574f-4c8b-8617-d9bc7d6d83de", "comment": "Malware payload (Vidar)", "value": "ca42535e9ebae5606184bf8555463e6b732ebb18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369352, "uuid": "8edaee1b-aee3-46b0-ad1f-d3cd4dd7329b", "comment": "Malware payload (Vidar)", "value": "532edffb12700a1851251444ba3c6fee861587fd5ad8f754f67954c11098a4de45638d5428b2b63d4e2cec0fbdba4a68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369352, "uuid": "4bc2a550-47b5-42b0-8e95-55cf2a1bb70a", "value": "T1095219C9B1C7A1FCC46DC239D74A4AB7EA653090472A0BBF46FC94642EC352075F8A69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369352, "uuid": "85db6a90-980b-4568-a201-27dfc1369676", "value": "b6039ed47f96f82fe109de7070ac3ad1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369352, "uuid": "48109131-e3a0-4016-ae98-d40fbf9cdc57", "value": "192:5FZEOzTh9R4hqLU6Qe5KgNTJaz9w0Kg0r8SkS3UT3Vws1D:5fRzTh9mh6RggNTJaw0gr8JS3UTlwsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369352, "uuid": "35467867-8246-47a1-b503-61cb02c47bf0", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369352, "uuid": "a153dd26-e3e8-4535-8e48-ccf16a9243f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369352, "uuid": "7743a6fb-9dee-4eec-afad-162de24e43cf", "value": "2b4345020809f679e81374554f2e887d3b8f88dcb0fcd1ea4758305049843eb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae8723e-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383667, "uuid": "963e9423-4bd5-47f5-928b-9cfdd04981a4", "comment": "Malware payload (Mirai)", "value": "ddd0a3625ab392a1d8b793fb2c9846c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383667, "uuid": "0e263a7e-e84b-44d1-8edf-b3bd06748bab", "comment": "Malware payload (Mirai)", "value": "2b56dda50c50ee03790c8e06509d1461e5b5e47f6dab59ec636422c55b1d58e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383667, "uuid": "99c13fae-553f-4c37-83b4-ffaeac9c89be", "comment": "Malware payload (Mirai)", "value": "8a483e7b5e811cec7642696dcba2ab1f6ec98b11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383667, "uuid": "2d9bcfe3-44a7-4249-ba8a-8ab6ab5f5c14", "comment": "Malware payload (Mirai)", "value": "2a33895761e9421a5a8068271391f427b23eb235d0fa153bba0737b19b624b381ff1b61684efb2d0633edb07dd14c400", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383667, "uuid": "b668ea29-a57b-4904-808c-21cdd380076d", "value": "T132345B4B77608FE1E379D67006F38BA7A6E9268612D38545D37DDE103A6034C682FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383667, "uuid": "057c1549-f3af-4704-aac8-855302d81f99", "value": "6144:G4EjaRofuihAcCM+p/nqOTF6FNs2lguXLsy7zbGiGs:G4E2CzAF1qOTissXGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383667, "uuid": "de0bae0d-7ee0-4daf-8b6e-67921b6a6141", "value": 249564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383667, "uuid": "24bb98c4-1dba-4270-9159-a96dfb34cbcf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383667, "uuid": "b737c94b-a634-4349-8cfe-511f48d405a1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc7a129-94fc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786394864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394864, "uuid": "ebd87010-da4d-4089-95e0-2f8e6d45306e", "comment": "Malware payload", "value": "1e57f0b9ad97c32422ddd5af26a716d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394864, "uuid": "0b269b0e-9cfa-4a08-b867-902a866ef512", "comment": "Malware payload", "value": "2b70b870ff77ff50ce2b088536afd4511a51d19b5732e398864306c0f2d186a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394864, "uuid": "34f04e8d-4e40-42af-824a-26b8e4ca282a", "comment": "Malware payload", "value": "f1adf0be9d184966057c3837e745f21503d56cda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394864, "uuid": "5cf5a088-8c79-4270-a3aa-37b614503c9f", "comment": "Malware payload", "value": "075ffa1fc7701d7adf3c9513a5ae2ca34b7d311ff6cbd6aa104afa52e1aa3a7e96c4c7b547ab9eb23d0748d24447b2c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394864, "uuid": "646ab289-f2cc-4a4f-a3d2-cee9a02e946b", "value": "T153D31B03ED856FFBC05ECD70452DC24A15DA5CAA92E5A22F71F8C98C7BBD20546D78C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394864, "uuid": "69e774f0-464f-49d6-91ac-48a5df7cedec", "value": "1536:X9x+yj6YHKFks7aKaIp5snSXsLWc5wG3svp9NlL22GLc8ErS:X90CHKFLb5sSXsKI3svp9zpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786394864, "uuid": "741d9c16-89a7-403b-a113-e273d96658f7", "value": 140032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786394864, "uuid": "820a8a31-10e1-42c7-a679-44da3bb1994f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394864, "uuid": "72f17bcd-1f07-4d95-bd39-b098045a5063", "value": "main.mips32r5el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df32072-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1786373740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373740, "uuid": "ccc7dcc0-7461-49cb-9988-e679b0477b10", "comment": "Malware payload (Stealc)", "value": "df18d490851ffdad16ca4809265ec622", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373740, "uuid": "123778aa-50c4-4242-9b7e-4e33ced0177f", "comment": "Malware payload (Stealc)", "value": "2bab9646ac4ee3ae95be5e9132f90c9411ffb4ba0cd4975aaf2fcd39d59825df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373740, "uuid": "83dd8542-89f0-4319-b195-365de8ada488", "comment": "Malware payload (Stealc)", "value": "0c96191926cf674baeaf8d07970f5ca465927c68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373740, "uuid": "261345fc-d03e-4649-90b1-6bfd08314760", "comment": "Malware payload (Stealc)", "value": "7d6af06b1e68de832cd4243bc1984f8559fb2bb1410201ba34df1aed832260738911a6579f11b7b4877ef6758aecef8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373740, "uuid": "3a7dc0e0-2c6d-41d1-a1b0-4aa01a6b3038", "value": "T195B67C07AC9648FAC09EA33188B746867B75BC091B3227D32E50BB382FB67D05D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373740, "uuid": "ee18e00f-f27e-44e2-9b09-1a08fcefe9e0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373740, "uuid": "c1603767-dc74-4251-bbfc-9f17705182be", "value": "49152:bJqqX100jFFXTr7eUamx9f6aFoU6Ysfmta1J3Z2:b31DrKAdWXmQ1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373740, "uuid": "5763d8ea-7543-4ae8-bf24-88161fdb50ec", "value": 10595840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373740, "uuid": "5259975c-1be1-404a-a4d5-b90fbd83a57d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373740, "uuid": "ef0a0ddc-862e-43c0-a701-987614be94a6", "value": "2bab9646ac4ee3ae95be5e9132f90c9411ffb4ba0cd4975aaf2fcd39d59825df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae328ad-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371158, "uuid": "034720a4-1b0b-4cf0-9b1d-ec8ff28823b6", "comment": "Malware payload (Vidar)", "value": "5c89493f49267faee52664db842efe94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371158, "uuid": "92678eb9-4da3-4c6f-b669-50725a30e12f", "comment": "Malware payload (Vidar)", "value": "2bc9177a939906cf53cdb3fb8f2b7d335946d43f0000524232427d6632e87f03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371158, "uuid": "a2edba98-f455-4e7f-ad3a-02f123b79dde", "comment": "Malware payload (Vidar)", "value": "1fe2af55c05801018f70f884d77f002a4756e4a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371158, "uuid": "03033ed4-e35e-4792-b0ce-2f21f755977d", "comment": "Malware payload (Vidar)", "value": "9207860f93c0ea2a63a0c0a270fca78756cc2844906743c61280b737b1630e331f427485189427447c82f976fcbed83e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371158, "uuid": "1536578e-9a34-446a-aa19-18d9c0ee39c1", "value": "T1CB422BCA765BE1ECC46AC239D6DB1566C53A340513A26FFFBB9488803F827306638D5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371158, "uuid": "e65253ec-9546-43cc-88d4-6134934944bd", "value": "db75e6c6266a5c5f87e60d9dd9f5fd3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371158, "uuid": "4a0a0e6d-8859-4270-95b0-dffad2ce7104", "value": "192:O6jzHbHH9wVXS6MQy+TlFDxCfpjp6sJ0oMqCQymn19uncDxT0X3VY:O6PH7dWMcFKNn0o+mn19AcD4lY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371158, "uuid": "390a49e7-54e5-4937-b91d-006b03871ab1", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371158, "uuid": "31fa3ea1-34d7-4fc6-be8f-2de751f4d480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371158, "uuid": "1352bd49-bdcb-4731-a13f-b579aa6b691b", "value": "2bc9177a939906cf53cdb3fb8f2b7d335946d43f0000524232427d6632e87f03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7e22f8-94f3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786390755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390755, "uuid": "b211af80-a1d1-44c4-9fcd-51ae66f237c9", "comment": "Malware payload (Mirai)", "value": "8df1c98dc22e4d4ec7910d3230ae81ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390755, "uuid": "9e97863d-ee7d-4a6f-946e-4a9108e69c5e", "comment": "Malware payload (Mirai)", "value": "2c42e4c9c0f3980dcb5b5263d328ef6929ff46df4cfd738f76acfd9237adc9af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390755, "uuid": "351e1e25-2ea9-4bcb-aff8-24d6d973b96a", "comment": "Malware payload (Mirai)", "value": "aee08a16c45755537c514e539c5a6f6af22838e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390755, "uuid": "ebf660ad-7ac4-4c75-9187-e04afbaae290", "comment": "Malware payload (Mirai)", "value": "ced9c2cd74327773576f46474cef725984e8c582e1cd43193ffd60e7623ddde27bb740a2f4e20f13ada1c4d186a75ffc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390755, "uuid": "fef800c1-44c6-4b3e-801a-f1730e511d5e", "value": "T1D8E3184AB9519F12D5C321FAFB9E814933136FB8E3F93101ED246F64238A99B0E77512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390755, "uuid": "1930da14-1881-426e-b34a-1bdd2763768b", "value": "3072:gif6tgBQI0SnLAXm4PaPvG0nlLmiaeoEFUrIV9ZilryuohGsKwvyLm:gY6tgBZtnLHr20lmiabEFUrIVLilBoUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786390755, "uuid": "7d66e5b9-f28d-4b5f-9e8a-ee5b2d6c6a61", "value": 150332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786390755, "uuid": "68b7b37a-6d9c-45f9-b507-4ba4a5fa88ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390755, "uuid": "54016630-421e-4ddd-ab0d-ffaf936db7d3", "value": "data_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f31df49-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372803, "uuid": "ce84e89d-9627-4ddc-ba63-1ca523b86086", "comment": "Malware payload (AgentTesla)", "value": "fe0a0f39e675b69655ff21783555167b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372803, "uuid": "664cd90d-6714-45ee-b006-3624b312d5cc", "comment": "Malware payload (AgentTesla)", "value": "2cc6c00766b50175445fd0878e922a3ae4b6cd4e7187ea985ea6b096ac086ba0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372803, "uuid": "8521fb0b-a74c-4bc8-b3d7-8c6111fbbf28", "comment": "Malware payload (AgentTesla)", "value": "c22e8fd11731a2f6da565196a49496728903e866", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372803, "uuid": "b71986f9-75f7-4caf-9429-578d3fc20090", "comment": "Malware payload (AgentTesla)", "value": "187e6047bc49d31e14f8375131068b75a646ab9429407c22845f362951bf4c1ad27feceada809e2d8c39a82a90593f7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372803, "uuid": "22ba1ec4-4935-45f1-991d-619ff0a7ad79", "value": "T18935F1142317D812D1D687B7F8E0D27432A49ECFBAD2C3D65EEA6FB7386A7C11984241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372803, "uuid": "c3a0da4c-b427-402b-9734-f0be1e00e00b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372803, "uuid": "0984160c-da6e-419d-8e94-df827042fa8a", "value": "24576:Gp50ZGsucJMciKxzPmWzD3jUvwAS25ms1+oOY/gpCt:Gp0JMYxLjawY5b4oR/GS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372803, "uuid": "3d058541-5edf-4784-a2ae-7c95b80d8ce1", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372803, "uuid": "e9dc2919-baba-4dd0-8201-1d3194a70e01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372803, "uuid": "7aa43a98-c484-4522-bb00-6635fba02a8a", "value": "2cc6c00766b50175445fd0878e922a3ae4b6cd4e7187ea985ea6b096ac086ba0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39566e4-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368730, "uuid": "0e7a6b14-f565-4222-92ca-72de06d44ef5", "comment": "Malware payload (Formbook)", "value": "60d2b5a1d00be1ea037d7fc370bb6d6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368730, "uuid": "aa332227-a513-4876-8bb9-cbfd418e1bda", "comment": "Malware payload (Formbook)", "value": "2cdb52e25f9467b3616c886851b604ec9c69d6038bfe2405d54c4ee474c8e694", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368730, "uuid": "a0be3430-1ccf-4f10-a83f-0c00b273aaba", "comment": "Malware payload (Formbook)", "value": "8da0491898b06bd502f878071d6c13eb872b5921", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368730, "uuid": "0cbbda36-6589-471c-8710-1742702c1a86", "comment": "Malware payload (Formbook)", "value": "a4ce49fe504496838d9a9e2218a4fb4073c70f2edd0b8a1f9dedd58afd9f3e170a4259d2306be15ae328a981c08f784f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368730, "uuid": "8be5e7e8-63ac-4e91-a2a2-814e8c2457d1", "value": "T1A7252328529CD811E6D947B65CF4D33206B02E8EB03AD32ACFED3DDB79937042558BA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368730, "uuid": "c96c2b1c-789d-4305-82f7-252b3a3927f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368730, "uuid": "c3851c3d-57e9-42fb-95a5-30a975e6922a", "value": "24576:0//Q4J+rFdKGYOfz8V66VtQ+iL/E8EXxX:03Q4J7Tik66bQ+ic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368730, "uuid": "3ca6aacb-6a58-47bb-97c9-c24a1ca7ed82", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368730, "uuid": "2552a2bd-18f5-4d66-b36d-0fa3c0531cf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368730, "uuid": "50e025c6-50f7-43a1-b072-65994c2814ea", "value": "2cdb52e25f9467b3616c886851b604ec9c69d6038bfe2405d54c4ee474c8e694", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7498cea7-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356947, "uuid": "18f6a886-0b95-4639-8f85-6ac4cb96f507", "comment": "Malware payload (Mirai)", "value": "a656fa4a3422ff527611cfb22e9e1257", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356947, "uuid": "d745af4d-441b-4c48-9405-c4e1ea725594", "comment": "Malware payload (Mirai)", "value": "2cf4fb390b5e2bf9f77b4ca68425e28fa10eeea16875cb43b8011ee81ce84ed8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356947, "uuid": "0ff0ea95-e158-4c84-a8c3-c6d100db2315", "comment": "Malware payload (Mirai)", "value": "9083ee0b3b74ef216a8fa5b4fbb89fc10f340870", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356947, "uuid": "d3954e6c-a83d-4345-b34a-a93cc7595f1f", "comment": "Malware payload (Mirai)", "value": "466ad5cdaf6efaddf741bc73f8f3055b4b1c031793b7d6ea734ea458528d0c68b019cf4b37d038686527b5e565dc54b4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356947, "uuid": "b9355ed8-425d-40f2-98c9-8ed60d514472", "value": "T179836C2731395607D0E1E1BB11F74B22B2D20BCE6358D28EBFA20D9F9E153506A66DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356947, "uuid": "e47c481c-b4ca-462e-8e6f-916f227c116e", "value": "1536:oSSpuNyJHa2glVXcyGDxyS6DLAR/e9OsodPSwwhsfiV0pbdUJdOoi:oStNHXMFPjS3pmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356947, "uuid": "7ec15313-2c04-4a64-a031-7fb0216cb2c0", "value": 86444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356947, "uuid": "21dce704-c894-44a7-9412-e584e1742c89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356947, "uuid": "9ac49610-49c5-4ea1-9719-c519da923c45", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd58b99-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371539, "uuid": "79439329-9da1-4fcd-bcf4-fb1652050a17", "comment": "Malware payload (Formbook)", "value": "988172bd1bca9dcfc74e9182f948a476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371539, "uuid": "8e7562a4-7881-4771-a121-e9fdc4bead31", "comment": "Malware payload (Formbook)", "value": "2d7135ac9a46920abc8c7c70c70389193835d3a3238fd61fb6316b9c47dc6278", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371539, "uuid": "7884a4da-f39b-418e-9fe9-5149aa3fce7a", "comment": "Malware payload (Formbook)", "value": "9d7011cbcfa006d2e5d99ae37c3e8e81afdb48e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371539, "uuid": "fd296011-8cd8-4a19-ae15-6fe4afc450a6", "comment": "Malware payload (Formbook)", "value": "1bc3a37b97278645164150eb5379150ea14ce35148a170c4d02d0ad7ddc536f02c1f393f597159030f6871472c4df611", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371539, "uuid": "8ca67264-e9be-417d-8c7a-c631f5a547f3", "value": "T1622512656256E617CA50237A4E62F3B527BEADE8A900D31BDFEDBDCB78327118C10143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371539, "uuid": "f0cca8b2-1bc1-4565-95b2-910c8d4ebb50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371539, "uuid": "fb53f570-b26a-402e-8566-cdef3e253bc1", "value": "24576:E1/6pz/J7636o0xhGIgw5YLbqja9TTtyD1J8XHwS:LF/G6GEXjITO1J83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371539, "uuid": "60050d66-8f81-4435-b140-58bac12b369b", "value": 1040896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371539, "uuid": "09c796ca-5c6f-4f2e-9dec-5f5325c7d0ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371539, "uuid": "fc656f58-fcef-4d3c-86de-d66346f6f2dc", "value": "2d7135ac9a46920abc8c7c70c70389193835d3a3238fd61fb6316b9c47dc6278", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e1205d-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370874, "uuid": "8ab7b188-aaef-4e5c-bf48-e8610610ae58", "comment": "Malware payload (Formbook)", "value": "84e9ad5822c699e199e1148b7545d983", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370874, "uuid": "518b23ea-9437-45a3-b21c-a2712d18ef0e", "comment": "Malware payload (Formbook)", "value": "2d74955d6968668844d6b59b1055739038fa8c26fd64b8ffba6a1b62006b10a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370874, "uuid": "352ac02c-9093-4460-beee-4b98478e96dd", "comment": "Malware payload (Formbook)", "value": "fa757c29a860ffeb04e3f835645dde6372bf691a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370874, "uuid": "493f0847-0456-4a7f-bb7e-00f0e6add4b9", "comment": "Malware payload (Formbook)", "value": "4c37d79b941ea7d269aaafdc3a2f9ee830e8ca4fa16d63c993229c5044bdf4733efcd48144b91a093022cb123b655db0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370874, "uuid": "0cbf902c-d8df-47b0-9527-3356be15d8f4", "value": "T14B350248231ACD02D5939EB08E74D3F816B95E88F411E7739EF97DDBF87B2862941281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370874, "uuid": "bae20951-2591-4f94-a309-3dcbc83dd9de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370874, "uuid": "e4bb164a-5491-4d9a-b841-a3c086700e87", "value": "24576:tnjR6pFsRTTunH2yfFJbrRjJ2okn8Dftqq4S71yCiRMD31Dek/lUjy:JtimRvurFJpjJ2h8Dfoq4S5ydRMTZwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370874, "uuid": "b383a560-169b-49c2-beca-008f92db58ef", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370874, "uuid": "e02d70b0-17cd-47af-877a-fb9cb3402e72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370874, "uuid": "3a1153ba-2ce0-463e-b791-92cca61eb588", "value": "2d74955d6968668844d6b59b1055739038fa8c26fd64b8ffba6a1b62006b10a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b29c897-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372366, "uuid": "05cef3a6-df42-4c6a-a0a0-c4e39b859e8e", "comment": "Malware payload (AgentTesla)", "value": "023a0b2f195f42b9bb4c08fee7bc268b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372366, "uuid": "f4dc78d1-6c5f-4adc-80ed-7778261e47e6", "comment": "Malware payload (AgentTesla)", "value": "2d82743ae026ce3c12a4e90d0d5ddc75943134e40bed325486edf5d0c7a7d68d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372366, "uuid": "d48deb47-a24a-4169-a603-542953abe794", "comment": "Malware payload (AgentTesla)", "value": "6a9bcd8a2f58a744171c855c76351c589c308768", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372366, "uuid": "1c2c63a5-b3b1-4ebc-947f-2ec3e02dc007", "comment": "Malware payload (AgentTesla)", "value": "3c71ea48bf0fcca4ebe9676ace6f63a68c7c5c1451ac74e6d58dfa6cf10d7801de9a1c59496e6d6c16f2025ca82135f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372366, "uuid": "b1991e4b-c554-4bab-8655-960ce30e87fb", "value": "T1AA2512E4B2E5EB19D7B64BF10D31E0314BB46C699135D30A8EEAADCF7A64F450860B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372366, "uuid": "9e22c4ff-26b6-4de1-9ef2-0ca191883b6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372366, "uuid": "afa629ad-f2b6-4b6a-a852-17883d275a3a", "value": "24576:eaj/Og3o80QzDieLl1cvswDdhWDCnss9e7VC471qKF:LPL0QSclEHDmCA7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372366, "uuid": "2982bd31-0afd-457e-a065-31643d428bfd", "value": 985600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372366, "uuid": "7f69a9d6-9fcd-40ed-a6ec-c9a1076ca47c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372366, "uuid": "6613a4ca-e2eb-487e-b804-42fa97ca5290", "value": "2d82743ae026ce3c12a4e90d0d5ddc75943134e40bed325486edf5d0c7a7d68d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4cadfc-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786373600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373600, "uuid": "b5ae3e00-67f2-40e7-b8f5-8ca87871d723", "comment": "Malware payload (GuLoader)", "value": "04334e4c4356edcd7e2dbb6edc5aa6a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373600, "uuid": "85f5279e-cd54-423c-b94d-1d1a3a5b676e", "comment": "Malware payload (GuLoader)", "value": "2d89c72b44ae19e629b7e5ae636c95dd1381806addda852d85068f830660b906", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373600, "uuid": "c6505376-f544-4fc2-9239-dbc8ac0dd78a", "comment": "Malware payload (GuLoader)", "value": "6493dce0cd60681781e51da6eb2fbcba0847cf6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373600, "uuid": "04ce7cb0-4665-4cd2-b3d0-cc4f1efe9502", "comment": "Malware payload (GuLoader)", "value": "49bdeb23c28eccf49a98a0c8f6270c80cdc0ddbf219ece15c60c7ff77838cbf85d7d5735da1280b2e112b680f0086558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373600, "uuid": "0121a0d8-5e42-45c7-80f3-84089bdc9bc9", "value": "T1E8B4121EF780D86BEE5265723476D3DA5BF84C764A39E74B7B183F08AAB30A04E17141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373600, "uuid": "ab774770-c698-4391-8b50-3f374bfe820d", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373600, "uuid": "e4857af3-600d-4624-99f1-0d1dae4a8a9c", "value": "12288:cHadGnZ7YYQGQ+XR8+pObcwvj2w3RUw31:4adGnGN+XR10j5RUw31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373600, "uuid": "e7d27e19-2056-43a2-9fc5-91e433bb4cb1", "value": 526960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373600, "uuid": "9b1c0649-1dbd-44de-be78-ba1f0cdc9443", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373600, "uuid": "9243bdf9-9c57-45cb-b5c1-3daf22b60dfc", "value": "2d89c72b44ae19e629b7e5ae636c95dd1381806addda852d85068f830660b906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1014ba48-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373099, "uuid": "184d69a8-7992-4374-8e2b-c5ef2e9b87a0", "comment": "Malware payload (Formbook)", "value": "e59847a5eebad47e446634f08339cc31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373099, "uuid": "25d953e2-8479-44b6-b666-67af44dc1867", "comment": "Malware payload (Formbook)", "value": "2dbd20c97b10c76aefdc90737cb8597ddef34f925d1ae347d2bb52f284db1632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373099, "uuid": "041bc833-cadd-463c-8a42-26ad9421bbe1", "comment": "Malware payload (Formbook)", "value": "7b751fedf7aef76d7d5ac653f39ba09bf2735d10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373099, "uuid": "65f08e5e-18b2-4212-a422-cc5af1fc2990", "comment": "Malware payload (Formbook)", "value": "b445a09e05b9cd41a13c694e83a33ab7e42a800c001c8cb521e96e6acdeb96ff07ef9f1b12d162ff04254ae3ba402a89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373099, "uuid": "79bb8e39-635d-4bab-a31e-fdbe7f4c38d9", "value": "T1EA35F154125BD802E0E6CBB2A9F0D37022B44ECFB9E2C2975ED52FFB79253C59594382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373099, "uuid": "75c1387e-27fa-4081-ad06-853d9fbed757", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373099, "uuid": "e5547181-d981-426d-8311-c3b0070b2b48", "value": "24576:3p50OV/+KN/hpLnQWGgfldX2I2JUoPSv2JL8wGF:3pnJ+KNppcjgtdymvmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373099, "uuid": "481047b0-8b45-49eb-bc06-9b1bb096d15d", "value": 1115136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373099, "uuid": "cdd3d28d-857b-42ff-a848-9d784377ee27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373099, "uuid": "9301d31a-7de1-4b12-90f7-ac3e64e63e5e", "value": "2dbd20c97b10c76aefdc90737cb8597ddef34f925d1ae347d2bb52f284db1632", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c92fc6-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786368388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368388, "uuid": "6a406ea2-0189-4597-af61-34c4ca3abe6f", "comment": "Malware payload (GuLoader)", "value": "9e63c418dc098c45c5a670697f73a884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368388, "uuid": "e0738832-f17e-43d1-8f1c-9ce699c29199", "comment": "Malware payload (GuLoader)", "value": "2eccfbe65c4f6fa456b7dcfec1102911bfae392dcb4d92f09356e6356fe3d5c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368388, "uuid": "3f8a16a1-42d3-4b58-91d6-9a339000c6b1", "comment": "Malware payload (GuLoader)", "value": "66ac84bf011ace0788e5c101892f1ba353992d1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368388, "uuid": "dc953971-13ab-4282-b44d-4128ee866b23", "comment": "Malware payload (GuLoader)", "value": "feebcec49bfe2e4d8ee49349253f711041e81c2d7f92f7bc65ff2197b660b4ef9ca120af966fd31105baaa4896f13bab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368388, "uuid": "c69837d6-f76a-4311-845f-fda127023f5b", "value": "T169C4F151B746D123DC1729749522D6D2D923BC359AA0C873B2DAFB0F26378E26C7232D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368388, "uuid": "40df264d-b244-4e0b-8b2e-41e991d58c8b", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368388, "uuid": "a91c61e5-eb03-45d6-ae4c-0f56bda84ab8", "value": "6144:jT4Dt9AZS49s1B6FIl+HFm2mrulGb40q6Z/9GCj0qs5u7jSkcH6T1ROMzDz1:jTsAXF28crKGbJZ/9GC9s56lcH6Tbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368388, "uuid": "a71bbff8-f4b4-41f8-9fcf-1447f2e1ae02", "value": 553312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368388, "uuid": "a4f4134a-a311-469d-ab4b-1c0592db3088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368388, "uuid": "318c2d31-4357-4e84-8b4c-9e81436ff0e1", "value": "2eccfbe65c4f6fa456b7dcfec1102911bfae392dcb4d92f09356e6356fe3d5c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f349931-94f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786390305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390305, "uuid": "e1b20095-1b43-4717-95ba-de86c4d45424", "comment": "Malware payload (Mirai)", "value": "0e613efff8df5510180906c0cf90f710", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390305, "uuid": "fa67e1fc-2b6e-4842-b624-5b412e3111b5", "comment": "Malware payload (Mirai)", "value": "2ecd02e58794bd4ee56accf98254ef1f296946d303081fbb49704deb51173c95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390305, "uuid": "291acf49-2f7d-4a4a-abac-8c446b80999f", "comment": "Malware payload (Mirai)", "value": "10017989230fc58d330fbaa340e15740f483287e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390305, "uuid": "c5c2cfeb-8908-4b7d-95c4-e96327d7ce70", "comment": "Malware payload (Mirai)", "value": "7141d826cdb4f9a9d50148427b0f614889ae6a5976327109cfe1926ad141c6805fed158e80b4ad7df31c0ca4b1d20a25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390305, "uuid": "0ec6c2a3-31c4-44c8-b124-316073ce9e38", "value": "T139146CA9BA0F6C41F1C6D3F9DE8C83E13E1735E3C77689B1791213ACCAA39D95990502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390305, "uuid": "1059782f-2ab5-4d35-bcec-e61ce13b959d", "value": "3072:icxmMrJ/mn0LyElvYRCSn6yjqO37+EEuKS7FVHJGQMrr3Snoq:iTMrJ/s0LyElQQA6wqy7ySRGQrnoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786390305, "uuid": "8eb54089-b926-40ea-98b8-652ff6ba6e55", "value": 202736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786390305, "uuid": "53a116e0-f0d6-4c26-b87a-7b41f4020b4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390305, "uuid": "3a53002e-2080-4ba8-a097-a398c233c5ca", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd611777-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786373068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373068, "uuid": "ffb32731-a83f-42bc-a8fb-e6ffaa3b2b70", "comment": "Malware payload (PureLogsStealer)", "value": "5d47e6b90474ab5d30a1493381315e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373068, "uuid": "2a5c7a1e-208d-4918-88f8-31d1b22283c1", "comment": "Malware payload (PureLogsStealer)", "value": "2ee7774c3cd441c37623cac190bd3903483d9c1cef360d4b84a8c309f0543de1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373068, "uuid": "ef57e791-57cc-41d2-a4fa-269edd55d103", "comment": "Malware payload (PureLogsStealer)", "value": "64310fba3957fc0c0560cea4a64666503eb9aae0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373068, "uuid": "ca82cc56-268c-4453-ac37-158c105cec8d", "comment": "Malware payload (PureLogsStealer)", "value": "1772e72a71c38dc490280f304ad740a426f35dfaa02cca3c114d6c4ab638adb9b11dd8db83b4c1326aa5220c09c97307", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373068, "uuid": "5db3a9ca-a601-45a1-88fc-eb674d430e6c", "value": "T111751205125BD803E4E68BB2A9F0D27032751DCFB9E3C29A5FE95FE739163C5A950382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373068, "uuid": "02bdf176-752b-4e09-bb0c-6e835176c678", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373068, "uuid": "03e4a054-62f0-4bb6-965a-e90f4f419c60", "value": "24576:Mp50f7PI74k759ZP0gLnCusM7fN3VAlsiW9A33dqZTtKk4qgLUrqO2vH:Mp4I77JcaC4VAWo33d+AknHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373068, "uuid": "39ea1223-413f-44c2-a928-3f7b1cb9f6c9", "value": 1692160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373068, "uuid": "8454b79e-91da-4b2a-95de-318d2537d12f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373068, "uuid": "38ceba15-918e-4416-9beb-30173ffeb15f", "value": "2ee7774c3cd441c37623cac190bd3903483d9c1cef360d4b84a8c309f0543de1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b81d3e3-948b-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786346114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346114, "uuid": "38a3e89c-20a5-4e4d-9b6d-417d9daedaf0", "comment": "Malware payload (MassLogger)", "value": "ae6a59c87e8ea27fdaf6b428eaf48e25", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346114, "uuid": "377f1f1e-8a1b-4e5d-899c-c1d7bc37a40c", "comment": "Malware payload (MassLogger)", "value": "2ef9d50b77db88c2e8e2e17a0fc04c4ab38e5356f86bc836dd132bdf03b922b2", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346114, "uuid": "89a9ac10-6051-45cf-bb5e-8b327d1d119c", "comment": "Malware payload (MassLogger)", "value": "417ebb5693b014f5cf1f4b75f6cd752a42316b9f", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346114, "uuid": "a073d48d-77a6-481a-9021-32d625ef9003", "comment": "Malware payload (MassLogger)", "value": "b4bfd5011697c3c1a0d1b2b7b5d31c6371694f958a4729f2b29029a286093ada76a2cac04ce9cac0940ccaed3cb35a8f", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346114, "uuid": "4293804c-88cd-4610-bcba-1a9005a632d7", "value": "T1E853B1A21E28C0E32E5DB45460C19FEE867A7117BDB94D0717249BA2CFBD1CB3E855C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346114, "uuid": "dbbd76c8-ed6e-4e31-9928-a900d6a8798f", "value": "768:dMFFKvQD6GPTAFgfvcR9DFfhKtxYWHddP9w/xzl7kIQd3GfY2d5vWbYrmGY+uRM0:Y8F666GTuROg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346114, "uuid": "6a132a33-bcde-4eba-a899-c1d0d0ee46e4", "value": 60926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346114, "uuid": "397f3368-bce4-4ece-bcf1-d3345d371d1c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346114, "uuid": "b44b4e79-404e-47fc-86dc-445a03d0270b", "value": "e-dekont.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c51e6e9-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370758, "uuid": "ffd7aaa3-8c6f-4341-ae7f-3f8247a5d072", "comment": "Malware payload (Formbook)", "value": "ff657ddc83226d6f028e88735959061c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370758, "uuid": "8154fd04-1d3e-4f8a-8b15-5bc049ee86dc", "comment": "Malware payload (Formbook)", "value": "2f03bad2bc7bf08deadf708941a5e1337c94c53b1dd3980b7a9d65bde4a4b404", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370758, "uuid": "6e3bad9d-2634-4943-89c8-c089d7e937a1", "comment": "Malware payload (Formbook)", "value": "e97114c8180135b2f480f5e67f469c3403618c50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370758, "uuid": "9cbe809a-742f-41e6-8937-183f37bb68e1", "comment": "Malware payload (Formbook)", "value": "f29d741c0656e24246572448a64fb083431630a581f34937ff9f5cd80af93681e281b663822529aedb3e8417b2b1b96c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370758, "uuid": "7ef5a0a6-8e46-4e3e-a194-a4c0382370f7", "value": "T1132523A8AA55DE13D8CA0BF60871F77FA2709E88F610D5578BEDDEC778189052C4C982", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370758, "uuid": "b1e9248a-2594-4866-a5a5-4eea31f147da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370758, "uuid": "882a3ad2-b6fb-41a0-af06-7e8bc842e7c2", "value": "24576:ISoNcnWE97RlOByAFaCSQyVzHLvuPrnmgGkh:ISooWE9llOByAECSQoLGPLmgGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370758, "uuid": "d91b8aa5-cd0b-4c27-a085-0aa6dc7f574d", "value": 1025536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370758, "uuid": "38f5c3ad-cbf2-44ac-ae3a-c65749702a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370758, "uuid": "51643c17-4324-4406-ba20-f5d6d1212eed", "value": "2f03bad2bc7bf08deadf708941a5e1337c94c53b1dd3980b7a9d65bde4a4b404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f1d0e2-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkCloud)", "timestamp": 1786372955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372955, "uuid": "d05bcdcc-1c35-4c63-89c7-0aa7c37e8d46", "comment": "Malware payload (DarkCloud)", "value": "1f5cfeb2b56735e2da6f69b949de6929", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372955, "uuid": "f26e6abc-95da-4110-b973-479662bc8c15", "comment": "Malware payload (DarkCloud)", "value": "2f0eb4634db7c6601bc5c6e2720d769da57e7598293f5881a58f4186c74687a3", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372955, "uuid": "7875d916-2c09-4983-b366-d5e6052eece0", "comment": "Malware payload (DarkCloud)", "value": "ad2846791bc3ac3ff8ae473d052b09c7d1180ecd", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372955, "uuid": "944fb501-176e-480d-ab2d-ab0913d9cd1e", "comment": "Malware payload (DarkCloud)", "value": "c94c77949ebd6ae6bdc388f4c780d46207174c716a981ae07fe4df7de488b20e1ac9fda40b650526bf62e498c177d2fe", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372955, "uuid": "3145d94d-056f-4536-a208-2c0010667771", "value": "T16A45015423268E01E1E68BF7B9B0D33537A84DCE78E2C3969FF96FE779193801904592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372955, "uuid": "ecc7d1c7-6cae-4f5b-8b47-86d4c271c881", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372955, "uuid": "8aa57488-f7f0-4e8e-887e-76d258988c9a", "value": "24576:MgigleGsWCQbGiHccJUnBv4VzrIhpOFsRgdAtVUxoLilp3+p50:sgEGVPbGZcJUn54VzropOFsudAjUmLYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372955, "uuid": "1b86f9ef-ec86-403b-b811-fc39ef5166d2", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372955, "uuid": "0cb993b1-ae06-43da-8866-645930188ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372955, "uuid": "8e05d7b8-5469-4df7-917d-faa4092e577b", "value": "2f0eb4634db7c6601bc5c6e2720d769da57e7598293f5881a58f4186c74687a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9d11b1-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370468, "uuid": "2d3a81de-8fe7-4e23-93d4-04383634c8fa", "comment": "Malware payload (Vidar)", "value": "352cca020483b2e0dd9da4efbfd1f01b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370468, "uuid": "b4e80e7e-02e3-4d98-9103-f7f907dbb95f", "comment": "Malware payload (Vidar)", "value": "2fff00b81878d8c45faab53a9e47b25e983e143612feb50b580c2a9e23c798de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370468, "uuid": "4b96cf86-23fe-42b4-abbe-59acb3de4fcd", "comment": "Malware payload (Vidar)", "value": "b12a32eb6d1d7738dbdb77c051436d977c8f1771", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370468, "uuid": "b939ddf1-c900-43a9-be19-5fa6ae310568", "comment": "Malware payload (Vidar)", "value": "3e3a422519bb29668e16e3b02058d798f71916744bf4775cadad36aceec039a094bd1bd027283180b72cec3defc1fe66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370468, "uuid": "ab7b4783-9d8a-447f-96e5-a3a6dae59432", "value": "T1D7520A8B70D771FDC1A5433DDA8A12E7D73A30990B0E4DFF86CD86846693650B4F8661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370468, "uuid": "901b3057-c67d-4c04-a562-9c792633a3e5", "value": "25141296cd904157b75686c0bdb5f4b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370468, "uuid": "bda811a1-b98c-4e90-b454-9034ce61d4d6", "value": "384:O9UxWsMFTy/ptyV0tl68vO2MPzyjlOtDKYTVzC0:GUAsGoLX6822M7yROtDKYTVzC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370468, "uuid": "5e1f233f-c2d5-4391-a191-a141750cce88", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370468, "uuid": "43b9461f-85ff-41b2-84f4-844c828af280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370468, "uuid": "4d3f2ed5-7af1-4b48-ba5b-e99c192f2c49", "value": "2fff00b81878d8c45faab53a9e47b25e983e143612feb50b580c2a9e23c798de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300e2b02-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786373153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373153, "uuid": "2cea1131-6d6d-4d33-bca6-d5716ef60547", "comment": "Malware payload (RemcosRAT)", "value": "e996dbd6325e6bd29a7c52d2d0e77334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373153, "uuid": "3409303b-e4fe-4d26-8a24-608e178568ba", "comment": "Malware payload (RemcosRAT)", "value": "303a507698ff9aab2d8df60f2ed2080e14204f3083bea4d5d01705a54cf6fea8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373153, "uuid": "0c2d9c5e-c459-480f-bf6c-7995eb45f154", "comment": "Malware payload (RemcosRAT)", "value": "4759a91ab07dbc6df6e6a0c56a7ce7d521e92b94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373153, "uuid": "b6fe9923-1818-4339-8636-a8251632d2a0", "comment": "Malware payload (RemcosRAT)", "value": "47c1f4027c624c767c5cd4d04ea2b08771e2966347f991fe9b4bb87e1ba1719c4ae24069d7bd4498377986d15185f537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373153, "uuid": "64d8b79d-a9e6-437c-865c-9591f0de9901", "value": "T14A55125423269E01D5D683B6BD60E33833B50ECE78E2C7929FF66FF378197812964192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373153, "uuid": "045d40bf-68df-4fa1-b5ea-9d6edf9bb454", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373153, "uuid": "25e11ce6-4d72-4eee-9cbf-62c5450a0ead", "value": "24576:Jup503VJmXnjWGZEhTeG1En+iA12gm/uHSvc4shYWFM8r2I3f:0p82XqGZjsE+pyvtmlFhiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373153, "uuid": "347a4abc-9851-4370-9baa-ed350546b9a0", "value": 1325568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373153, "uuid": "20d82343-4c5a-44be-8592-b3ad07cce7bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373153, "uuid": "9573aa84-ff4f-41ca-a890-580ab018c0b1", "value": "303a507698ff9aab2d8df60f2ed2080e14204f3083bea4d5d01705a54cf6fea8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2108a1e4-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340057, "uuid": "ff4038b1-26f9-4f29-a11c-9c551c60f278", "comment": "Malware payload (Mirai)", "value": "4d280660638420ae894206c80af5298d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340057, "uuid": "8842201e-46c8-473e-87d6-afc561ff89cd", "comment": "Malware payload (Mirai)", "value": "3055864bc6695a7a1b5f2fdb665bf2cc82785b5565f201fbff18d7087766b1cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340057, "uuid": "f2cb7094-f702-4607-9184-bc3e837f2a01", "comment": "Malware payload (Mirai)", "value": "b3e182f3166082e93c7175c7a91b84dcd92024c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340057, "uuid": "d1476045-32db-4006-bf50-aaabea9195d9", "comment": "Malware payload (Mirai)", "value": "9813eefb26b65cc64246e64840ac72a0cafc57aaf51bf1d2f503d58f5d2f19e0eca48acfdc36a004711dc2632eec83c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340057, "uuid": "e2e53d4c-598f-4400-964c-3c42b0f19689", "value": "T1BC743A88A2F1FACFE158EA755210BC2A5D624A3235D371C6719FFA7713B728009ED970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340057, "uuid": "ce320932-e00d-4539-b4ca-ab757b780b2e", "value": "6144:/v9OAJa7oS0NekOfzfTnr6E5yBw+fhzx5J6+LZpy+a93T:/VXJa7z0NelsBDfhzx5JrXa93T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340057, "uuid": "05422a2e-d5c6-447f-a416-3debc691c815", "value": 370112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340057, "uuid": "5de70399-c687-4b31-8e68-2122952aaa2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340057, "uuid": "07d1b1f4-3eae-4350-9d36-dd32054eb131", "value": "vlxx.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0619ea75-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369217, "uuid": "d5c05fbf-567f-42b5-9ea4-2795361ba6b5", "comment": "Malware payload (Vidar)", "value": "1278b43a220a9798d8a1a73b113cc7be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369217, "uuid": "1780b827-e17c-46f8-a52d-6d01808b0ed6", "comment": "Malware payload (Vidar)", "value": "30656603bbf3ff3204c83216ceeb0efc5b64c97841e6b1dd35ac7e97b968b10a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369217, "uuid": "8d6519f7-ee4e-473e-99f4-324e6b61f52c", "comment": "Malware payload (Vidar)", "value": "f93160ab999a5a23646ac0ce8d68ba09fa9b4a38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369217, "uuid": "f760b832-2783-411e-a03f-ad55b9b1c108", "comment": "Malware payload (Vidar)", "value": "8b039a7cb42d14d45b7b6e787ffb9fbee3ee098e7ddad6748d744c5cb5b776015cf0552ff038707662985484e4a9a1b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369217, "uuid": "af7d2b4c-455e-4fc5-9509-0753c11346ee", "value": "T12042EA8AF55371BCC099C3B5CA472366DAB6709013364BBF06ECD6651FC22B06AB45DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369217, "uuid": "0d1572e8-c38a-4526-b1e6-b646e1fc3ec4", "value": "f0e3160a5bd62fbc1af1bbb43e8f6a5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369217, "uuid": "8ac65d21-a7f5-45b0-9a0f-28757cd69965", "value": "192:Okx5BKxymeGq83vHyNLSM04vpionoQprn6wMU4/ENqpTFm3Vup:Okx3AkufwlvpiFi7wR0lup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369217, "uuid": "1345408f-4afb-4686-a145-5a9e0a24affa", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369217, "uuid": "309120f6-074e-43a0-aeda-b54f3ab3211b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369217, "uuid": "7465ebed-95a9-4aeb-98f3-7e1e7fc6e52b", "value": "30656603bbf3ff3204c83216ceeb0efc5b64c97841e6b1dd35ac7e97b968b10a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7de17eb-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786371663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371663, "uuid": "b91d142f-1910-445d-8e74-b1b0d891139a", "comment": "Malware payload (PhantomStealer)", "value": "9b02e39caa6d20ba3d1356b5ee665aa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371663, "uuid": "5b42bef4-23f0-45b8-acd3-0b4150cd22ec", "comment": "Malware payload (PhantomStealer)", "value": "30dd5e040135cdbc455db82da73669757c4efa81f29e4c639f3ee98e24de140a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371663, "uuid": "919d5aa3-8e65-4dd9-8ab1-eb6173cae80e", "comment": "Malware payload (PhantomStealer)", "value": "68b036b67728f736a439a611c336bcb6f3d1784e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371663, "uuid": "a9e2b2dc-f3cd-43b6-920d-667f3ecbfdf0", "comment": "Malware payload (PhantomStealer)", "value": "9e5d4c386b7d6baf085bc25ab621f675575aadb5f174d2aaa9d0811bf6fbee98f09007370d97dad93827c01472035521", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371663, "uuid": "ef19b3f6-6931-4c2b-9538-938e2146733f", "value": "T1BD74F1282F6DD61AEE710F389DF9F731856C9EE46C628F8B671435257A30BC09C4931A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371663, "uuid": "fcb658af-8d42-468a-877b-42148def2ef8", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371663, "uuid": "7a4b105f-57a9-439a-872a-d376f166a30e", "value": "6144:mT4DtYa/h305o9fgqMUuBQWYmETqukoucsUpDj5t8vfMO3x9JEGuzj:mT+Vso4DUoQFmETbrLGkAJEGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371663, "uuid": "e050f6ff-a79c-4ed8-9459-222c85208f3f", "value": 365752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371663, "uuid": "781eac6d-7da0-4da9-ad58-cf78a3186af3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371663, "uuid": "c0c3b9cd-30de-4aff-b23f-00ee822407b4", "value": "30dd5e040135cdbc455db82da73669757c4efa81f29e4c639f3ee98e24de140a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d36e8ac-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786374088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374088, "uuid": "3723c915-1ebc-43eb-8d6e-d28c7ea742b5", "comment": "Malware payload (njrat)", "value": "7311320686afe0a309586adb63442d46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374088, "uuid": "194da474-ddac-44aa-a4e4-8b89bd87f1cc", "comment": "Malware payload (njrat)", "value": "30f8fdb26e5ef75f382fd927a35e00ea8accd504e677058b7fd28e6a73553d40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374088, "uuid": "845ef049-5687-4390-8a63-6d592c8169b0", "comment": "Malware payload (njrat)", "value": "1dc70364adbe70b7f1396fb1ae54bd56769b1f4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374088, "uuid": "0d229f65-9b3c-4381-b6b1-96a8388d845f", "comment": "Malware payload (njrat)", "value": "3a8bd6ccb26747db649cf559d6577d6a7834134064b356ac18d666dd8f3e26a571f86106e499387b3d2fbf5405b9b43a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374088, "uuid": "db8354da-a5fa-4d13-aa94-8056161cf2e7", "value": "T1D80502582A16EA06D99243B80BB1E3B417BC5DDDE820E3179FE9BDEB7629F444D04343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374088, "uuid": "f52ada84-dff9-4269-bdcf-5ad94ca73b70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374088, "uuid": "c01a80a9-1abe-4758-87be-3bb9de7685b2", "value": "24576:ueA9sc3qymb6fWdVLO1pGsy+Jp238NtpY3:PUs+5w6MVLO1wIp23a+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374088, "uuid": "52585fdb-be10-4536-9744-c90ac1a1e310", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374088, "uuid": "e1aa7c61-4a75-4bb6-9b62-d8f0e07664a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374088, "uuid": "7159f6de-8c1f-482e-8f4e-1799dca6c5eb", "value": "30f8fdb26e5ef75f382fd927a35e00ea8accd504e677058b7fd28e6a73553d40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb0a653-948d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347195, "uuid": "f25d82d8-0798-43a9-b73b-357c57193650", "comment": "Malware payload (Mirai)", "value": "5c5d7f2062bbf875c11244e1b87f5af2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347195, "uuid": "4557761d-a7f4-4715-9c5b-68d824e077ad", "comment": "Malware payload (Mirai)", "value": "311ac74c800cd4ce5bcc16210127e7b7a8522253f34d4d4f0f4007365fad856a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347195, "uuid": "b2fe95f9-2264-405b-8c26-2f5efb9e086b", "comment": "Malware payload (Mirai)", "value": "f236a976f97f555a65dcf791dc5be06a74097884", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347195, "uuid": "63d108ef-5e7c-4be1-a242-7086fd7bb2e5", "comment": "Malware payload (Mirai)", "value": "09f8b1629d6e9a3deedd6378e25c388171edd9b4c802817319eeb49272669bc939f3479fdbe22736b0ab6b3f0ded224e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347195, "uuid": "399afeef-53ab-4766-ad4e-31a9d2ff9e0e", "value": "T17A057C6377318F64D364D2B006F387269A9515A207F261C6937CC220BA61B6D6C6FFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347195, "uuid": "7c1d463a-09b5-4b09-8222-e02990c985ca", "value": "24576:Lyn4WhdWS1twR4SBFFgsrO168dZtZY9n8X0cW+e:Lyn4WkxBFesrObXZY9n8Xze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347195, "uuid": "51597670-4af0-4ace-beed-809ea91813c8", "value": 821480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347195, "uuid": "7cf77a1f-d7f5-400c-a23f-41c313afcc46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347195, "uuid": "7fcca323-13e4-4119-9b94-0c351508ec25", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369ed2d0-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371876, "uuid": "4f52fd29-6718-4d25-8d33-6d4c254098fe", "comment": "Malware payload (Vidar)", "value": "46c4cb407a2144f74975ed0437e48a42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371876, "uuid": "541b67a2-0138-4be1-b61d-7af3a13635df", "comment": "Malware payload (Vidar)", "value": "313f6f205d61106cc224f4e733624422176c8ead85c7442f062e8209813fa589", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371876, "uuid": "580ed542-8d8e-4a55-b57e-e702ee6ab7d5", "comment": "Malware payload (Vidar)", "value": "a3353b67c5a12271386d0c8e9adede64cfae1cb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371876, "uuid": "37a7a126-09af-4ea2-9577-cbde9b5e5b63", "comment": "Malware payload (Vidar)", "value": "0253829fc4752c03a2edfe70b760ee61d93e07775bc0de6ca8167deb6317aa583ea1f5c3f8c407d1fea839984262cc59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371876, "uuid": "a76e3aad-84f1-48c1-86ed-8aeb9a2a437a", "value": "T157422947B192E0B8C079937CCADB29B6C31730CA232E5BBF0BECD95867C255129B8714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371876, "uuid": "cc93010c-c82b-410d-b9c1-1daa67937953", "value": "b5dedaa92e3b299ba2882a40f166187c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371876, "uuid": "1b835343-ef72-4c7d-bc1e-da5e66f49a5c", "value": "192:OEzH9Enoh2kGefGuAl5Kirmabt0A/+pmykGQMDxWNIZVSBpEEhfOY3VjY:OE79Bh2kGefGzvK6bt0ATZM9WkEzlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371876, "uuid": "cd060eb5-10bc-48ba-aafa-1c9a25adc498", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371876, "uuid": "a0bfeb09-8c0d-4b3a-8116-b51fde48f604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371876, "uuid": "985aba5c-abce-4beb-88c6-e88c125c270e", "value": "313f6f205d61106cc224f4e733624422176c8ead85c7442f062e8209813fa589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ccea93-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368683, "uuid": "97489fc3-3a25-4536-aae2-811d91cc4f60", "comment": "Malware payload (Vidar)", "value": "df5fe0a1f8cefc01363cc50171e1cb4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368683, "uuid": "184b9c2c-b619-49f3-9df5-d7bdc5fe6c54", "comment": "Malware payload (Vidar)", "value": "315c6d6b695651e4655e04dce2c13e8f26ddb1355a6c5464767f61472d5e5193", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368683, "uuid": "2d9e5668-bda7-4acd-9b55-084125a63e74", "comment": "Malware payload (Vidar)", "value": "46b085268d264496e6f917df1fc09824c751682e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368683, "uuid": "f1031b9a-b0f4-4324-be41-5960ff7df577", "comment": "Malware payload (Vidar)", "value": "227170d825f1d4da4172226803b906e492f0a909b22cd98b8602fa6e4c8b41362f68ae1490309d2d25bb82d56daa335a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368683, "uuid": "72987199-05cf-4f5a-ad49-2d0cdfb43fd6", "value": "T1E04209C676D2F1BCD16A8338DB99267E46263085230D5FBF96DCC44437C356264F8B98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368683, "uuid": "86068047-e7f1-40ad-84c8-eaf92f53add9", "value": "23f0624fc03678983bf84a686b8ca727", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368683, "uuid": "c8d0886a-f5c8-4516-ab74-93488215ba61", "value": "192:OgNoxW7Jlfl1h48e+UMYMJ5f5+RALIq3cmddF3VZqauEyZPew2SiW:OgNoxuNl1+feJJ50qtDFlEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368683, "uuid": "72a28c42-31d5-4581-bb2e-b198184cc740", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368683, "uuid": "d59fa439-3df7-444b-8432-82bbf4823382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368683, "uuid": "a1623b43-8a77-4840-93a9-33d2156881c6", "value": "315c6d6b695651e4655e04dce2c13e8f26ddb1355a6c5464767f61472d5e5193", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478eec52-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786368468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368468, "uuid": "b3026a50-4d51-4844-bafa-dff2a7c82da4", "comment": "Malware payload (AgentTesla)", "value": "391d10ec407fff9c5d772d47e933b676", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368468, "uuid": "cdb13803-13b1-4ce8-acfc-854ceb965301", "comment": "Malware payload (AgentTesla)", "value": "3165d5a8e90f522dd5d0cef3c1f00f21c0472928658626cd29680d424281a62b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368468, "uuid": "7cbfd514-9618-41e2-945d-264c76c2761b", "comment": "Malware payload (AgentTesla)", "value": "d02a83d9016b625481aee8e5dae1bff431761a3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368468, "uuid": "65f58df4-913a-40f4-81f9-894f41ff1c72", "comment": "Malware payload (AgentTesla)", "value": "7e3e900747420ae0883a76635661fe041eb407a64b1284accd2f9295f095c35d37638bbc1d22791813c463dbf8136f59", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368468, "uuid": "6bb92a18-61fa-41ec-add1-4369ed6d00c7", "value": "T1103502C03B39B719DE641735E939EDB442F91DA8B110B9E25ADD7B8BB66D200AD0CF01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368468, "uuid": "79e7628c-133c-474c-bb90-d2644ef440c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368468, "uuid": "e2fba20c-22cb-4ad4-8218-0867b6b0c28c", "value": "24576:M1BejbsJ9JjVRYi+l286alB5uF8NpvSWSEFM1:MVJHbx+l2SPuipaKFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368468, "uuid": "023baf5e-c426-4f79-816d-4f568eacdb96", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368468, "uuid": "09d575b8-95b8-41e0-a9f0-08b9ee7d451b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368468, "uuid": "27d71659-cca7-4069-96f6-73cc6f35df1c", "value": "3165d5a8e90f522dd5d0cef3c1f00f21c0472928658626cd29680d424281a62b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e4084c-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786368552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368552, "uuid": "185a6999-ad8f-4979-a665-c7121f61be67", "comment": "Malware payload (AgentTesla)", "value": "432ea3f66f1383932f5d045b83c86fb0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368552, "uuid": "74d8e236-1817-4e53-bc7d-6b95ce3b4059", "comment": "Malware payload (AgentTesla)", "value": "31857ab31779658b85e71641c6989c81b8fc65426ba18f527c4078de6e863d0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368552, "uuid": "66e31868-d00b-4529-95b5-a60da53da387", "comment": "Malware payload (AgentTesla)", "value": "2fcec803e8a59b7843b3b8a9b886fb47865df4d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368552, "uuid": "4cecf60e-2a5d-4409-9f8b-b433d1274886", "comment": "Malware payload (AgentTesla)", "value": "81c0a80f2aab2e3e7c959da0f3ecf52bab5d22fbbc6e48a777a6e086cd3dedd0a3466553f2691c554e62c7fec6227545", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368552, "uuid": "5bd9d7a1-831e-4678-9fd2-06a8e2f6a96c", "value": "T1BA25F1C03B29B709DC686B348535ED7553A92D68B020F9E26EDE3B9778AD3015E0CF52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368552, "uuid": "a592809f-fe70-448c-bfe8-cd3cde1ce391", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368552, "uuid": "231562fb-65d3-40ae-9f84-47fcf760c8e1", "value": "24576:1qGdMdXf3ftQv+GzXpOvNSE1awH/QdXBFNnn26Xbj8e:1hdcHADXsNSiHSvNnVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368552, "uuid": "4c222a13-4865-4d45-9f59-cf61bf106745", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368552, "uuid": "eaeafc24-bab0-4cd3-a3d6-1ae4d1a77414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368552, "uuid": "c5152fb3-6de3-4dbc-a7f7-e41d2705c28b", "value": "31857ab31779658b85e71641c6989c81b8fc65426ba18f527c4078de6e863d0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b40271-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786371690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371690, "uuid": "456b54b5-bc97-4dff-a7af-c89a44f2f232", "comment": "Malware payload", "value": "4fb53e314be4146f665a636ce7889664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371690, "uuid": "41e3b363-6736-4441-9aba-359aa1c4258c", "comment": "Malware payload", "value": "31ab86366c8c2c2533c7af01b151effd7399d730b1b7911e58eb8e371911dcf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371690, "uuid": "0f4d93db-7181-4645-8638-bfea80e104b6", "comment": "Malware payload", "value": "a3199ef0989f563d2a52a5877bbf17c1b66bd22a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371690, "uuid": "5ed4182a-7d06-474b-8a51-6bd7517fe105", "comment": "Malware payload", "value": "c9b54a992a517343b0d1d1912c3cdc1a4b593a02a5fa2bce6c1ca8aac3df4a3854cb8f1be68949d13ea7e3ff493a3c37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371690, "uuid": "427cfa1c-152f-46e7-afdb-3069b4d01932", "value": "T10DD41210EB82D8D9D1768574D6F5D6F66630BCDCD920632B5B08BFBABC39A44CE39204", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371690, "uuid": "69fa4135-473d-4cdf-9fdc-804d810d1459", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371690, "uuid": "230a9d5a-df12-4d17-a5f8-4bda97d5c80b", "value": "12288:wtg++Nmxxy6Bhfll71ZEZBhA3+vRcndQmQZC7qJj:wMNmnBhflB1qZA30ydQm0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371690, "uuid": "121785c7-b533-4a4f-98fc-0f9a0dc596ee", "value": 644688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371690, "uuid": "d4e63e8d-b50c-465b-8a68-a2163169dc0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371690, "uuid": "a38d185b-2d0b-4c34-8160-6f7dfda56483", "value": "31ab86366c8c2c2533c7af01b151effd7399d730b1b7911e58eb8e371911dcf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d3b2b7-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371371, "uuid": "a2f68712-2c02-47b1-b882-5077f8c8012b", "comment": "Malware payload (AgentTesla)", "value": "63dadf8edcaf0f8ca3db10e27e062804", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371371, "uuid": "abb195cb-10c1-4147-802a-e494ad5856e6", "comment": "Malware payload (AgentTesla)", "value": "31ea3201b32324df05845cd92467364f4ae49e021368bc810b0e8bffd0543e61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371371, "uuid": "82ff1a91-a034-48b1-9691-25fea833c491", "comment": "Malware payload (AgentTesla)", "value": "e974e1c388bc9e38c5c45f79d343d49ab12b9072", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371371, "uuid": "9e4dd38f-d819-40f6-b73e-530bdcbb4004", "comment": "Malware payload (AgentTesla)", "value": "5f81fab3f58af8d7734f7acd123f7beb272392ca0114787d27114d873b50e255dff36b659880c53a9611a91b3e58309d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371371, "uuid": "87b057d9-d024-4a94-b04b-d544698860bf", "value": "T18D4512247254F216CA852B781AB0F37A13F52DDEA012D7125FECBDEFB926B010D19693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371371, "uuid": "07dfd696-a2ef-43a6-b688-6b4c6ca13d22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371371, "uuid": "07c3167c-b810-4459-aa48-a3811e4411ce", "value": "24576:WV/+lUZTCoCxm607txZbuWmBwWZxdmuGHL6S:RGZTCnmJBxZElZxo5L6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371371, "uuid": "cde72603-9952-469e-95dc-35e4a1d5c0ca", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371371, "uuid": "7614bdb3-7a11-4d49-b671-a1c87dfe24e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371371, "uuid": "e93ebbf6-4817-4b53-89a9-4369d7907f02", "value": "31ea3201b32324df05845cd92467364f4ae49e021368bc810b0e8bffd0543e61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a24dbe1-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786373707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373707, "uuid": "8406d59a-37f4-4757-a3d6-99eeb55a154f", "comment": "Malware payload (PhantomStealer)", "value": "1885399e7d845a538fe8e915ce0b1efa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373707, "uuid": "4335bbf7-cbeb-4470-a952-72c691cb7be2", "comment": "Malware payload (PhantomStealer)", "value": "31f433267321f551c97ffe2d78bd29f6551adeec6b9af6a1b95bee0f52a9b7c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373707, "uuid": "4b22569d-e38b-4f68-a6fc-8c59b12b4a01", "comment": "Malware payload (PhantomStealer)", "value": "73369dc8f55ad3bdf01bfbc94dc897b4bb312dd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373707, "uuid": "9b82d52a-508f-4287-8245-fc68207d5922", "comment": "Malware payload (PhantomStealer)", "value": "06f3c40528d484176c9e54ceb4c455b916ff9a37dc2feaf98c957f842eceb77adb12e470b09d542fc932d4525db790a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373707, "uuid": "4565d5a4-2415-4624-9697-ae334ec03874", "value": "T16945122816678807C4E27EB99EB0F0F497789DD4F239922A4FE50C6FF56B1427D80326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373707, "uuid": "874dd105-e8eb-4e61-a40a-e7171296712a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373707, "uuid": "0741e757-6526-4aed-b549-13f38aae4196", "value": "24576:sOZWFeSkGu8X+ctDEn19AtOYGf3IqMdM:sOZWAL0onvArGvIqM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373707, "uuid": "6b1bca66-28b5-4053-9e2f-cd5df8fb4ff1", "value": 1180672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373707, "uuid": "fbca8b50-6ec7-4f40-96c4-5de0938763ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373707, "uuid": "65655cf7-ec81-4131-a441-98eed370f8cb", "value": "31f433267321f551c97ffe2d78bd29f6551adeec6b9af6a1b95bee0f52a9b7c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c175e163-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370391, "uuid": "0c04475d-24e9-4922-8647-3f1e1aa455d9", "comment": "Malware payload (Formbook)", "value": "1de299113d4df40184dd83fb177a837a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370391, "uuid": "f20d2534-fe9d-46c0-bc15-34ae788a6aa7", "comment": "Malware payload (Formbook)", "value": "324b1ae63d608956def08a3041d854ccd16d1905f5d5bbfb0385a9106f63025d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370391, "uuid": "deb539c1-e91e-4a06-8368-ec201976ebaa", "comment": "Malware payload (Formbook)", "value": "e49aba3b54bdf3cec1f55dc3d0f47131ef448b80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370391, "uuid": "737e859b-08df-4c73-87d0-9e1cead83276", "comment": "Malware payload (Formbook)", "value": "724460674d3b789729cacc9cdfededaf2a8d65d3ec3888ac643cbfd1d381d066ce746a86d7f34cc04bdd6d92ed850c96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370391, "uuid": "eca17afa-9261-4b1d-b807-9ecc8c175855", "value": "T1673512645E4EC412C0D21B7409A0F33842B56E9AED31CA175EDDFCE779F7A09AC187A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370391, "uuid": "00cdb6ef-d3e8-4e99-975d-84ec417af51a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370391, "uuid": "6a21f3b1-3b29-49b0-96ec-ae0d18f9f21b", "value": "24576:4Nj/0gD3de4Szrp4iUfeOROxO5TU7aIQu2rg4EdgEc3oA+vCxTPOZMCWFJ:4Nj/0gD3de4Erp6JYxO5k4u2M4Dh+vCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370391, "uuid": "057b0112-9605-40c9-a5ef-0860cce8a6dd", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370391, "uuid": "9186d057-9788-4a07-a3cd-abd7cbc3f90c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370391, "uuid": "aed30468-8129-4e47-87db-d6c80f6894a6", "value": "324b1ae63d608956def08a3041d854ccd16d1905f5d5bbfb0385a9106f63025d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4944294-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368221, "uuid": "4c1cd3ac-53b0-4dea-8909-cefca4fd1a44", "comment": "Malware payload", "value": "29980d25febeb00552fbe51ecaab22d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368221, "uuid": "0091978d-18e8-478a-9053-ebdefc841ca6", "comment": "Malware payload", "value": "325f72a5df88f10ec123667268740c0b32a554db2cac9dbfdc0ddcb16a6edd43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368221, "uuid": "f593fc41-439f-4006-a0b9-8728bf9a7295", "comment": "Malware payload", "value": "48b0181f0a938da1e69e6add47e7cc1204e55816", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368221, "uuid": "5f7ccff2-8814-4ba3-9860-a159144bd7a0", "comment": "Malware payload", "value": "c661ca5b91a4e3a8da7443c7d24159106fbf7e644dfde624ce39dc2238b40f6736610c63ca2249ab13e216033c612d62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368221, "uuid": "c98ef68c-4fd7-4275-9df5-c0376b8f3e51", "value": "T14465F6C733A401BFEAA6DD7686128507F6F17F0D0262861EC6607F75EE3E6E1162E211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368221, "uuid": "4c63dbfb-d407-4595-a6c3-1422ca2a0e7a", "value": "638af1c562ad8f76992023c9692ec222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368221, "uuid": "c9c4492f-1793-425e-a55a-3d0bac7e3d2d", "value": "24576:MCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNreO:/1H4jR2TYrQbDTre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368221, "uuid": "7456bb6f-55df-43b5-87d9-cb0a56093c97", "value": 1416704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368221, "uuid": "6bedb289-1f99-4b49-bfb5-48133fb17aec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368221, "uuid": "773de72a-3663-42a6-a14c-9fd4648eb2ce", "value": "325f72a5df88f10ec123667268740c0b32a554db2cac9dbfdc0ddcb16a6edd43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5e4893-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786371452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371452, "uuid": "72a1d7c2-7c20-47c4-8cd4-9b03342f7f06", "comment": "Malware payload (PhantomStealer)", "value": "319f72540b445f8326b92a0b5c99ed35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371452, "uuid": "31f8edc0-d97b-4c0b-aae8-937354e1577f", "comment": "Malware payload (PhantomStealer)", "value": "3282a697cd30a544c0d3fe24d748676c28da50350c2bfbe4738826e3d9f68b6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371452, "uuid": "d1306421-6e86-47a8-9ba2-e88ab8f107ee", "comment": "Malware payload (PhantomStealer)", "value": "d62dec2255f51e841dc5855f2ef547518ab3aa80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371452, "uuid": "f9ef326b-732d-499c-80f5-923aa61570d0", "comment": "Malware payload (PhantomStealer)", "value": "98072d07b9f328c7ac1d66f15785c14b06b82f7cebd6e8864e813a7ec9a2f557865adeefecdcbbb6f2a086a4c7a016e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371452, "uuid": "30353134-96af-496c-bff8-2d38af5278a7", "value": "T10EB4222DB75E8B7BC0B99B7C94FB365719703B8204B1BAFD589463B61B13A310750D28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371452, "uuid": "de9b8181-6eb6-4273-932f-667bf422e2ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371452, "uuid": "851a7eee-583b-4315-bf9e-aafab645bbc0", "value": "12288:kMvebqob2mEajSTSMlrrs8MbUwJnH+QivO6zOkVc4:s24qZvs7NeB2oV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371452, "uuid": "2e681907-9132-42e1-aa02-32af4e34754f", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371452, "uuid": "768b510e-048a-40c7-9b4a-dbb96f20be5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371452, "uuid": "cf44d7cc-366a-40bc-8887-ca2249f7ad36", "value": "3282a697cd30a544c0d3fe24d748676c28da50350c2bfbe4738826e3d9f68b6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62ada9b-94e1-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786383256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383256, "uuid": "ce0e21b7-3f2e-49bd-a938-02cfe90e033e", "comment": "Malware payload (RemusStealer)", "value": "aed45aae8615c1da1abe40c18ea0dfd7", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383256, "uuid": "3cfaa378-252d-4df1-9551-6852e112efa2", "comment": "Malware payload (RemusStealer)", "value": "32c100b984e2a26d588fafc648dcdd7694788d0c18af15704e3601ffc001f334", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383256, "uuid": "fa89e6b3-ec46-44fe-b05f-0a8e6573222b", "comment": "Malware payload (RemusStealer)", "value": "7ee91df07c1922d3b9a8c0154d4ae603bcb0dd85", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383256, "uuid": "073c0734-4445-458b-984d-54afa48d45d7", "comment": "Malware payload (RemusStealer)", "value": "3d1b0b55c6b997a53b6f048d4e373a5bcfe4b2a8835792be7b5b62605da57c786e64305fbc6fa771b1c89c90c16d9a60", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383256, "uuid": "d61da67e-d98d-4350-ae07-58177a7574c1", "value": "T130D523DABAC66E54C474C3B4524374BF327F37888C619E473ACCAE406EB6518643B762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383256, "uuid": "c53c76d2-3358-4e4a-867c-ce60a135d565", "value": "6a368102586dffa13aabff685459b467", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383256, "uuid": "2cd9823f-d6d5-4fd1-adef-fd1ce9ea87f3", "value": "49152:e08PsrWdChqpuO3yIEL9CnYjD48khLVkhaGrb7n9iojzJVPNc45TTSIYbmUDZ:e0viKOCIERi4D8hL6Vb7n8OXG45TWjbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383256, "uuid": "aed27125-62d8-455c-b7d3-fd2267ea706e", "value": 2918568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383256, "uuid": "3fe9367e-a52b-45f2-8d0d-911e11779fb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383256, "uuid": "3bdbea4b-ea30-4aec-98e7-34d7b0055b88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9d9b06-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373359, "uuid": "8fcd60ce-52b6-441a-b041-2778d00fd5e3", "comment": "Malware payload", "value": "91b615758dd13c8b12d7f075d66405b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373359, "uuid": "6e227330-e179-4d8f-9413-36256f02e226", "comment": "Malware payload", "value": "32c3d8d011591ce7d7bcb96a2227d5e7d70f623299100d8421c889f65219ed08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373359, "uuid": "7f611b22-db78-4f56-9e52-2d87aad78880", "comment": "Malware payload", "value": "ef38a74374bd6012d3260327da2029ef60f7e409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373359, "uuid": "11e50bde-3483-45f5-9e13-551a035f46d7", "comment": "Malware payload", "value": "990ee6cb162e962569f1dd4036c0adf47b8cac763c2e52b32a1f934c52b9568f5cb5b9c1bc58dcf976561150828cf9c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373359, "uuid": "01232a6b-7520-4bae-aed7-4fa5dd27e49d", "value": "T113B6023FB28B653EE06E5A3A7972A110583B7A6165134C1697F4C88CCF250B11E3FB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373359, "uuid": "47f3f632-6bd8-4adf-a670-b7b58a34e516", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373359, "uuid": "a91a8af9-d982-404b-85b6-dde9323afaa2", "value": "98304:c5OV+kz1ktl80FgIU8rzyvry5y/LUV4v:4EWtKf8aTky/LUV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373359, "uuid": "af36cf91-08c6-4fa0-b50b-ea9e3ab3b7b7", "value": 11222098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373359, "uuid": "1bc49126-493c-485d-a23e-05d451231943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373359, "uuid": "2939f6b5-88b6-41b3-b91b-182b687ccf65", "value": "32c3d8d011591ce7d7bcb96a2227d5e7d70f623299100d8421c889f65219ed08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eda8f62-9466-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786330148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330148, "uuid": "a7dc2265-bacb-4f60-a3d3-b5446265324d", "comment": "Malware payload (PureLogsStealer)", "value": "42080c1c904c9da1c3a56db89dc44d62", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330148, "uuid": "2943ddc9-193a-4512-b2f5-c3bc6e7a8f03", "comment": "Malware payload (PureLogsStealer)", "value": "32ead15908ca61088701ec6ee4c692658585746bafb52cce23c047d035fc91a5", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330148, "uuid": "62aba100-531f-4411-9905-cc0f8ed6865e", "comment": "Malware payload (PureLogsStealer)", "value": "78625ada2c1150ba449da78370521663c1785f8d", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330148, "uuid": "290f0ce3-7eeb-4865-85cc-0c2f9876bf04", "comment": "Malware payload (PureLogsStealer)", "value": "183af939ec72df0f21d3c030e4ce58c6117ad17ead77f74302ef182658c9ddc9e8c1511a95f8c932a7bca32ef938b746", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330148, "uuid": "9e04fba9-994a-4966-8727-3cf4eee3c8bc", "value": "T1BE13F8E6504970491AF3C1A138D0E0D2B8CBE9136F9F5FDA766C94900BF13E476EA9D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330148, "uuid": "8afaa049-cc9e-4a57-bd03-f427e391d507", "value": "768:prUMuOSDrUMuOSBrRrUMuOSDrUMuOSBrfr/:AjGjqjGjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786330148, "uuid": "1e8dca8e-4fa7-494a-b286-d1622e34b682", "value": 42030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786330148, "uuid": "4c95c88b-1921-4029-8db3-aff13bbf079d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330148, "uuid": "3406018a-51ed-42b6-8529-0b760b432aec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70f15c4-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370829, "uuid": "84c974ca-2da1-4d4b-aeaa-91794690bc91", "comment": "Malware payload (Vidar)", "value": "b41aa9edb7699465a194bf3bb9d73f72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370829, "uuid": "3fbb9098-b381-4e29-a511-967a21ad7988", "comment": "Malware payload (Vidar)", "value": "33a6dda775655ebf2bfe25ce820df5829abb4ddf55955fd98d50b3b2d2db6789", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370829, "uuid": "08b31539-ce96-4833-b0f2-228c4386d4c4", "comment": "Malware payload (Vidar)", "value": "cef88f5aef2116a28fdcba85c47c0244febd542c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370829, "uuid": "96e46ddb-2d9f-4fa9-8d26-c4e5381ca748", "comment": "Malware payload (Vidar)", "value": "5a4dc88ba58b8aac4de94b84e5eec5102fc53a0ad4adb3043ac059b1e24cf88d2f429522eb3a5cfba1b2b0cde38b2b8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370829, "uuid": "8a8a7b5f-a136-439c-9cde-a4f53cd965e3", "value": "T11142F882B582D1E8C0A7C370D69621EB9572340007326FBF679843956F9273577BDB8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370829, "uuid": "791851eb-2f0e-4451-bc54-1df190cd9193", "value": "66ebb7345b7f4b21730e0a314cb2039c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370829, "uuid": "7c4649cc-2d8f-4c2b-a185-601c1918197a", "value": "192:O/E5DasL/+FhOno0BqdhS2R3oBRrhEShQVfbfCWnRcuc+3VdkVCwlcqM:O+HL/U0BqdY4oBfGRflpc+ldkVCwlcqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370829, "uuid": "a5b80a96-e552-48c7-8c9a-058d07443164", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370829, "uuid": "d5ab2fc0-d969-46ad-8754-2cdca03826fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370829, "uuid": "b6351a9d-da02-4154-beee-f9faef369b81", "value": "33a6dda775655ebf2bfe25ce820df5829abb4ddf55955fd98d50b3b2d2db6789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9332477c-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373319, "uuid": "e076ab96-7f3b-4217-933c-36c52b86055a", "comment": "Malware payload (AgentTesla)", "value": "9a765f1c66677f75071b26ae2487b1d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373319, "uuid": "387db0b3-a6a0-48d6-a636-8bfc46f238be", "comment": "Malware payload (AgentTesla)", "value": "33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373319, "uuid": "5af6e015-fb93-4d30-ad61-24694e35619b", "comment": "Malware payload (AgentTesla)", "value": "2084f98c0a2055684b7db1063006057117e4840f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373319, "uuid": "bc540c7b-24b5-4c4e-9d4a-1d521c05c09a", "comment": "Malware payload (AgentTesla)", "value": "91a8bbcfa7a31266314a3b718185ada871c730b2136941d4550140fd1d73283969443375fa88f4719e1055e508c34b95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373319, "uuid": "30313fee-5b39-40ed-9ffa-301eaa7284fa", "value": "T1527402A37351E443C5600774597B8F20F7E5EC686A87275B2B80BFAD7DB32C1AE0A251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373319, "uuid": "ff08d1f4-5c78-46de-94e1-c78a4cb34527", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373319, "uuid": "2f1cedd5-8930-43ae-986a-ad34d6fe04a9", "value": "6144:KxFS7C/noG9vC2+J3xSfHcjrZBXe2xkESEglIQ3yBwKIeeJP:MeAnoGhC2+V4fHcjNJfkESN3yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373319, "uuid": "02f3f8e3-8e27-4034-b3ea-464828fcfa0d", "value": 351552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373319, "uuid": "a0d719e4-3a3a-431f-a1cd-e66a50c51083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373319, "uuid": "c00ea1a1-57d7-4ce6-a14d-af057068d28c", "value": "33c6c3f66da3cc8bfff614235ab4b8774db81dca72262e772af4201664750ea6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396de185-94ff-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395932, "uuid": "05329ca2-8376-4bbc-9973-3273db6bc3e7", "comment": "Malware payload", "value": "68872e78100d262e7b1c7a215af98607", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395932, "uuid": "99a87096-89a8-42e0-933a-3d62224f2d3c", "comment": "Malware payload", "value": "3424ce7c4060bc34552aee23b9729cf8e7667bacdebf6a793cf74771a4e25099", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395932, "uuid": "3361d2ce-7438-4e87-a7f4-ffe5641d3f57", "comment": "Malware payload", "value": "f9b58acbc78c3790a7a5a40a25639f0ddb70e833", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395932, "uuid": "9233eb57-0130-40e1-b007-1c9106b67aa8", "comment": "Malware payload", "value": "b2efd5024908c37edb637bd59ffb1d8a4af579ee9b1195ae92077d10e2771837e0d86aff55eec562b60a2c3c40693023", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395932, "uuid": "181a6923-107b-4990-b201-546fed775d0a", "value": "T194D097A32023567180228E60E0DEBC0077204B3E9CC0EB6D313760B02F45608F8E03A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395932, "uuid": "e7c5adf4-4aba-4c7c-ab7b-09fb568f544e", "value": "6:hTfcryvOWNiF0OAulNXYq4HvXDG+NjVsNXYrkJ:Vfcr280OPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395932, "uuid": "83942db7-443b-4f05-8ddd-d2dddbe00bfc", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395932, "uuid": "ce5719cc-5066-4478-9c88-a16b33f44b69", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395932, "uuid": "23f6be91-ee19-42ff-9d55-7c9c29c3d27c", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6d0d14-94d9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786379809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786379809, "uuid": "b38f08f8-8c7a-4911-a7de-8db768c527fb", "comment": "Malware payload", "value": "be7ea79554fe27f6943f411c54c97467", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786379809, "uuid": "da2882e9-1255-46ca-a9a9-a2c9691946e4", "comment": "Malware payload", "value": "3505a8bd68b86e233d4e873bee78249de7b37843fbb393b883dff11ffcbe147f", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786379809, "uuid": "9ceba40d-0be3-4fc2-8669-b479c9d5710c", "comment": "Malware payload", "value": "a988474dc083e6314c384a1d3eca4854e214cb5f", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786379809, "uuid": "3b1b9dad-e478-4cf5-8156-af317f74daf2", "comment": "Malware payload", "value": "b8c4356ebec32e56d469eb2679d98f378b2bf69a3032b404336adfadfb0470fc018b793fc6c4b936c3768ab0a01969c2", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786379809, "uuid": "9fc68331-0bbd-4738-acce-d75f4fc47d9f", "value": "T1500633E5761B2521FCB783B1D273B54F67A2F38C268C9F412216A2D0D1B2BD09DC65B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786379809, "uuid": "a2c1a1e2-1523-482c-b585-8a188cfbbab6", "value": "081b147442ec931223b8226f8071e65a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786379809, "uuid": "56e75c7a-6cda-4ceb-bc2a-de1ba6cd16ee", "value": "49152:YLnb1RDohUv4+Ovo8aVMtDXC6K6jLFxsfykSpflmj5rrznHfflQpJk09ANgrNVJN:ynjDmoBVMtTgmH45zHXWJR9ANgrNnJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786379809, "uuid": "3a2b38a3-5b32-4ae3-946a-a5bd6ea874a6", "value": 3704320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786379809, "uuid": "d960c8ae-50cc-44e0-abe3-b6314584a388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786379809, "uuid": "42990b34-f09a-4065-9561-f45738cf12fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f474dc-94e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1786384249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384249, "uuid": "7398565e-4f90-4f91-b033-106a1ed766f5", "comment": "Malware payload (SalatStealer)", "value": "e4f179223eb1625f8f41825a05a0950b", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384249, "uuid": "f079b4e1-b2e3-4232-b519-633eaf14e8f8", "comment": "Malware payload (SalatStealer)", "value": "35889a75f0d7c9f13f2b1d41507fab3f29244bb06aa22582847c52d04c6ceb21", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384249, "uuid": "c1724cd6-95df-4b5d-8763-2720250f1a2a", "comment": "Malware payload (SalatStealer)", "value": "61cdc06b4f2133548b0458ca07b5e249904a851e", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384249, "uuid": "bdd6620f-9056-4111-bf54-92912c0856b9", "comment": "Malware payload (SalatStealer)", "value": "0ec8a19878e1b2be3b7f755e61371bb8cc1242b365c9a01b6a3d8e09c13c0e64b26207da1a323ce3a7eb462c6a91d6ef", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384249, "uuid": "b2aac04e-9b28-4575-bc2d-ecedad019970", "value": "T11176B0B876047DE6A67F577BDA96ACDC13B516239A8BA8CD8064B7C30563331FE02C05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384249, "uuid": "f417e58c-dc7a-438b-9e61-650f08c2a4a6", "value": "d2921ee0468211e522a7bd2607503c56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384249, "uuid": "050737d7-d150-46e9-b26d-c4acb5614ad3", "value": "24576:Pa/8b01CY+9HJx4+wZyrG7OVgcZWmOoozq7JcOH8y9nM3ULSwhTMcNjrFRWIEACP:s1CzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786384249, "uuid": "64b7616f-4f29-4e88-ad45-20d6e3653552", "value": 7617536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786384249, "uuid": "100ec810-bb06-4c35-9ad1-8592c59d46ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384249, "uuid": "d7df631b-8278-4635-846f-6dd44b45a119", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4a6287-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372289, "uuid": "cb9bd089-db0f-42a6-a91c-b90d4a39e31b", "comment": "Malware payload (Formbook)", "value": "1e4917c2eca73663d2d3b70c50852da0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372289, "uuid": "4975a4d5-d0fe-4744-a5d0-6c4e8079ca46", "comment": "Malware payload (Formbook)", "value": "358b96d1ae69bb09fdc02dde646114157564d587f3c09137b49b2b459c791b55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372289, "uuid": "08e76488-883f-485a-85c2-411f64cdfa38", "comment": "Malware payload (Formbook)", "value": "7c6c6f57e290efd7ad95b0ffed2b8fe52a712562", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372289, "uuid": "e485414a-e068-438b-b800-5246932a2e12", "comment": "Malware payload (Formbook)", "value": "9a9fa9d70d20ff049e5a7cdeb32ec2f1a51bcf29e0414239e2540ec816331b32f7096b38c5987b3fcc2ead905cc2c35b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372289, "uuid": "c5e71ec6-0244-4857-8171-34a9781492e8", "value": "T14655F12B6E16B93AC37507BF0820E0744BA85D5A95D4E20379DEFEEFBD39E021548243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372289, "uuid": "52fe334a-e080-4c4d-8815-3b934d2bafad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372289, "uuid": "c999ad43-4bf4-4dd4-8fcc-bf1afad85f7e", "value": "24576:Hj/Og372BiNN7WA6RffUQA5xu2t3u7eWNggmelhhKGe:DPLIiCA6JVA5g2t3t+lhob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372289, "uuid": "47f7fe81-2856-4caa-9349-075f6f934b48", "value": 1388544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372289, "uuid": "13e8f585-392c-4a1e-bf7b-af1734af9d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372289, "uuid": "c1d59f0e-ae34-4811-afd0-0a88eab01e4e", "value": "358b96d1ae69bb09fdc02dde646114157564d587f3c09137b49b2b459c791b55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3f719a-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371269, "uuid": "318a40b5-c63d-4e8f-ba9c-8b031e1fe38a", "comment": "Malware payload (Vidar)", "value": "fa19567b9ddb0c325f9476d47587cc6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371269, "uuid": "9cc4000d-1eb8-47d2-89e4-c45546ff7401", "comment": "Malware payload (Vidar)", "value": "35dfad63f5928fded9378e9063ca6454a0dde8f7a200a58f6a71fd38944b964d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371269, "uuid": "b0301cf2-96a6-4af4-901a-712cd297088d", "comment": "Malware payload (Vidar)", "value": "9e4ccb402336e984f255492a433e7bc279620afe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371269, "uuid": "5f4d2082-3e7e-49e9-b46f-b8867fe7f030", "comment": "Malware payload (Vidar)", "value": "77b5a877d7fce4371c6c7761d5567ff1974f67de473a2da58d45dd0a7d6fed08c368a90cbe5d2c247b9260067144e8ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371269, "uuid": "7d358a94-fc83-4534-8c79-12a3bd4327fc", "value": "T1FF42F9C7B1EAB0BDD2B4C278DE5B0777D3663085032B5EFB51D8C4A826839916174B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371269, "uuid": "010bc70c-ef89-4a7d-90cc-53182f6881d3", "value": "309ffb298c8a47c3e92f759e8f202429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371269, "uuid": "005b893c-caef-4744-bddb-f3f97a835fe4", "value": "192:OtEL4on1JlvjgV0Z0b5dJNQiUDE0tXnnozsDqwuT13ZOd4Z3ViNP:OW4onXlbgSZ0ldJKbDE0tXozsDzuh3CE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371269, "uuid": "24ec5102-35b2-4298-9b88-0ef3efb0add0", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371269, "uuid": "aad4d763-c763-4a75-abc9-33062afeb78b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371269, "uuid": "529e0dfd-a99f-45f7-a144-ab7ec6f557da", "value": "35dfad63f5928fded9378e9063ca6454a0dde8f7a200a58f6a71fd38944b964d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33854563-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786355550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355550, "uuid": "c70775e4-551f-48f8-b5e4-854ecf23a90c", "comment": "Malware payload (Efimer)", "value": "d56a844710acf7ea3634f90aa5ef4d49", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355550, "uuid": "4c18600b-5e31-4337-b7d9-f9b77c8d9592", "comment": "Malware payload (Efimer)", "value": "36949ef5549bd8fc7b223933fac780475db87e66144f9a404fa70061e4a2916d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355550, "uuid": "9f63a95a-3a09-4a72-a1da-dad4a0c09d26", "comment": "Malware payload (Efimer)", "value": "74ff6429b527c1f028dd8cd11f35b9a499085d44", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355550, "uuid": "fb9a308e-af5b-42d0-8de1-cb9567dda1b6", "comment": "Malware payload (Efimer)", "value": "9913caec5d6a6bf7c169216b2c20f2707f3e48190fba635bd8bb9d8bad0a319499b33a8271a2554f3175b83669f5b472", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355550, "uuid": "4ef9696a-c455-4faf-9dbc-cd63a6c77cc6", "value": "T14BE63388BAD411AEED6312BCC9D10512FBB5B8BE4730C4EB47FC57656D632A10C3A729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355550, "uuid": "d926531d-f7a6-4910-bbf9-3986be06c537", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355550, "uuid": "2e8398cc-882b-4698-b780-73434408c526", "value": "393216:HGmZHJMyUl+szQ1VCTaNnXMCHWUjecuI3/PGTAI:HGQCV+gQLJnXMb8TH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355550, "uuid": "faae0e0e-c1c0-4a56-be56-edfc1c67431a", "value": 14292314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355550, "uuid": "e0620ece-4b1e-4ac8-ae89-5c12a320433d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355550, "uuid": "205d03ce-57bb-4450-a0d6-c6e16119cbf1", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e08063-94fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395518, "uuid": "fb2911ee-3f00-4a36-8da0-6cbdd12236a9", "comment": "Malware payload", "value": "13aa85c7753e1a75f8b3188cc5a70449", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395518, "uuid": "46957f2e-123f-4900-b873-531c854562b0", "comment": "Malware payload", "value": "36d3d96a1bc1f13abbd5ce1ea182a25358999bc3274d9f3998eac5cdc5f3aa50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395518, "uuid": "06c617d0-f5c4-402e-b8ec-a9f388fa55da", "comment": "Malware payload", "value": "1592eadcf92c7a7b0a31f41570e3168bd1d1966e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395518, "uuid": "b887bd5a-1e21-4e7d-93ad-0b4d9c1fb5ab", "comment": "Malware payload", "value": "9fa541e08876bed1646c30423bb95de38078bb7ffb0afbd45fa6afe4b36d12cb9360a811cb871010c745b684972fe41b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395518, "uuid": "7555c27c-81e6-4a9a-9257-7e1056c95685", "value": "T12DA43955EC809B95DAD12ABEFF1E824973131B78F3EE72119D061B3163CB84A4E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395518, "uuid": "eb0ef1b0-f57e-4d39-aa23-ffa55c9bba67", "value": "12288:RHHWM+dvq69mrFx14766QVqeCgSPGAAlbg4n1a2jb2s8kK+TUx:x2zvXtK5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395518, "uuid": "9bde0169-8ba5-4716-8bc3-39181dbe0777", "value": 476820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395518, "uuid": "4e57c016-2a77-49c2-8944-147abbb6a639", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395518, "uuid": "b297c902-5f67-4110-a849-03a01a0311b2", "value": "rxwp.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec38bff-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786372775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372775, "uuid": "a9b9ba8a-461a-49f9-a814-71690d973954", "comment": "Malware payload (GuLoader)", "value": "10d143bc7a79499d5a11e954d51ca3f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372775, "uuid": "fb6b1b2b-69d4-4a73-82e6-1b8d2d326272", "comment": "Malware payload (GuLoader)", "value": "373a6410430d15948a76f157d22fda6c5245d0f44d5e770d0b365263d2f3f22a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372775, "uuid": "b8312181-925b-4d25-917e-cbb536880d76", "comment": "Malware payload (GuLoader)", "value": "bdc5c8e131265de9f0de49b356f9ca5e3c0922ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372775, "uuid": "e46d2772-40d6-4399-841b-ae0a84b650f8", "comment": "Malware payload (GuLoader)", "value": "21b488c08564a3e71e3c14bc33328e9d5449e1327921e960890b9011e54e87248369bb89f5931a1737fd89623a813b48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372775, "uuid": "9d60b31a-eb98-4394-8025-e1c1fc2f5aab", "value": "T15BC4E0C5BD109176C4AC4736E06EA66F0A6BFF2D01741A4327ACFE2B3A7C752450963E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372775, "uuid": "8a201387-65d9-48ea-8763-436947ad9415", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372775, "uuid": "3616f471-b007-4f95-95b1-8ccf82bab269", "value": "6144:dXsKoGYtiurbSqqbyxjPXNOfowRG/VvQ3aOAi1Q48mgNNvHESLsoXDYS5U:dXctpOaxJOfod/JmaKQ4ngNNvHEqha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372775, "uuid": "d9b93b65-73b7-49ac-83a3-f66709a92b43", "value": 564192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372775, "uuid": "c98b3c31-2e5c-4b15-81d0-cc801fdb7474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372775, "uuid": "43dc68b6-b2a3-4314-820e-1fbbdc3d5632", "value": "373a6410430d15948a76f157d22fda6c5245d0f44d5e770d0b365263d2f3f22a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e5ef89-9460-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786327777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327777, "uuid": "6b25da00-def8-4437-9c2a-ac764a4f562a", "comment": "Malware payload (Prometei)", "value": "2970a8a61e6614818fec183b2e98b614", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327777, "uuid": "0fa11ee6-5c35-41b4-adde-b2b15e509a28", "comment": "Malware payload (Prometei)", "value": "37889641ac36cf081c187dc147939e329add2f571bd41363c8d4e5639bdb13b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327777, "uuid": "f1c1a393-e846-4f6a-94e7-a8ba91053aca", "comment": "Malware payload (Prometei)", "value": "3ffad3dde380a4c2782d0d4e7177bc8aa841d78c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327777, "uuid": "c1e1b82d-329f-44a9-8032-7d999efad045", "comment": "Malware payload (Prometei)", "value": "c8504c6d6fbb9c8259a750f78886c73f712efd9c171be1257eb69820ef1e57c37fe8743e31649ae59471e77ec0a03e17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327777, "uuid": "ec64a268-d010-4ff3-8272-b36113969e61", "value": "T141445A13B201DC39D75206B1AD9F9B52097A7C391F3316DB73B01AACD6F01D2AE25B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327777, "uuid": "34a35610-d5b2-4873-9985-632a43b7e7da", "value": "497ec0ba56520a465b1c189de65cd68b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327777, "uuid": "b42eefbb-bec8-4b8b-bcc2-ae40b9aa21bb", "value": "6144:7rAvsdc+iejBwJsyamsyo2iI0RnemvRGo0AsfZQ:7rAUdc4jEsyamsyo2i6mJGo0AsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327777, "uuid": "4364f188-0625-4d97-843c-0dfa0f6723a7", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327777, "uuid": "c724864f-197d-4ed5-90af-2ee028fdfe92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327777, "uuid": "95e3c703-197a-48a9-93cb-66ae518c4b4f", "value": "f4ac4f735b9ff260a275734d86610dccb8558d1a54c6d6a78a94c33b6aaf6e39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b491d14-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373145, "uuid": "b0a782e8-33f8-4285-856d-f58bde248e96", "comment": "Malware payload", "value": "47b32d67a5162f0bb255bf2083582782", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373145, "uuid": "e6260c70-f5bc-4494-bfee-be2183908d40", "comment": "Malware payload", "value": "3870075ada881cb8d92a9d5b37c49b5dd50741ab7faf00985e3e52c769a4aed6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373145, "uuid": "5b1b51f1-aaa1-4b19-8de0-c53087d42b27", "comment": "Malware payload", "value": "c421916e27cbf957eefd0ddd4b20fc6acac0ff4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373145, "uuid": "b2781191-60fc-4006-8ac3-7ee127e8272d", "comment": "Malware payload", "value": "1f45b9552ea40327f7db8f0b9627a8b2c7eada09e01bc4cdb320193cbb1fa1745d81a0dab41175aa388574db7be75cdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373145, "uuid": "0ed250f5-2b18-4ef2-b480-51c61bac8ffa", "value": "T1D3E57C07FCA118F5D0AAA3318A36A9527B21BC481B3123D76F50F6B82F72BD05D79758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373145, "uuid": "212706af-8309-47e8-88b8-b330a0ce17e8", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373145, "uuid": "2921c9e4-4f1d-48ed-ab9f-4d5a765b9fa2", "value": "49152:Dl8WXuiExBm7RaXlkxprTUwjuNMQwQuOchgOgnH+5ZP:DlBR4gg1Xi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373145, "uuid": "124ae29c-12b8-4e87-bc44-ec0fa5bc4d31", "value": 3163136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373145, "uuid": "bfc5e19b-fa3f-46a2-aa5a-a34b83f2fdf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373145, "uuid": "03bd90c5-04f6-435b-9234-d4250031972a", "value": "3870075ada881cb8d92a9d5b37c49b5dd50741ab7faf00985e3e52c769a4aed6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89613ede-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373732, "uuid": "e24cfee9-3963-4bb2-82c7-545b3fda88f4", "comment": "Malware payload (Formbook)", "value": "976f947588b5ed37b2e65e2f09150024", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373732, "uuid": "09d441f1-abfd-476f-ac13-144a2ed34824", "comment": "Malware payload (Formbook)", "value": "38769a2e4f94e3b64653527637ba7d977a607577c4ef056629f1cd83480a8fcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373732, "uuid": "309578e9-8640-4cc0-8b26-9c0a8ed86e12", "comment": "Malware payload (Formbook)", "value": "c3eb130ebeb2ead2774c3df99eb7ebcb75c06fa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373732, "uuid": "c8fd1f66-a938-4af4-bef4-1ccb04eeb57c", "comment": "Malware payload (Formbook)", "value": "b3dc79659c05d3f4ab542dd902a109baa5a23e680cfa0c80b203074a9ed1022671656489e4248ae0dfff8d0b9115afb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373732, "uuid": "33b3415c-23cd-45d5-bc4c-f7e5dcea6196", "value": "T1EF252314A2959113D0B75BF899F1E53463767EDEE630C20E4ED62CEFB462B088614FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373732, "uuid": "40892791-0701-4121-84d8-752573843836", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373732, "uuid": "8ec7acfd-97a9-41e6-96b8-7597dd44bb98", "value": "24576:SJAK+LvrJgaC4ScLc37o/6Rz9AEFoxdeQi2Kkii:xLvrtCOLc37o/6Rz22ox9Jz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373732, "uuid": "1ccce85e-ad23-4536-8145-8a61c0f2e6cd", "value": 1008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373732, "uuid": "4369a328-f036-406a-b1b2-9bc4bf33768d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373732, "uuid": "87e99ff6-7e30-47de-ba36-2669cef12ce3", "value": "38769a2e4f94e3b64653527637ba7d977a607577c4ef056629f1cd83480a8fcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1913a1d6-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371397, "uuid": "cbecfc2a-7c3a-4b14-bdf1-1eb08242fab0", "comment": "Malware payload (Formbook)", "value": "8c54e44dff2fe5fb41cb3a987b86c982", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371397, "uuid": "15add3bc-2e93-41b3-a62c-997f12102c67", "comment": "Malware payload (Formbook)", "value": "387775ca164b849ef3e6db1658e240e02601ec5036a1accf17026791a51e87cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371397, "uuid": "665ef234-a348-4775-a843-e9f4de2db248", "comment": "Malware payload (Formbook)", "value": "4a1b4fb0876d6fe2398fbba27a3a9358b503a184", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371397, "uuid": "8e92f979-5e03-45e5-8ff3-8113fc427377", "comment": "Malware payload (Formbook)", "value": "1b2c623fdfb304cf83d4c9f41623a3c73b386c08e2875d566525f29f1b3d8a98f2926f1c8c9162f97ca07cca51e7dcea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371397, "uuid": "b222e537-016f-4bea-b798-8295ee7b9322", "value": "T15325130C5612D413CA565B395EB1F37922BD6EADB800D7139FF82EEBB93AD154C202D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371397, "uuid": "bffdcf86-19d0-49ad-81df-8c8f70a6772b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371397, "uuid": "ebdfadf6-006e-4b1b-81a0-b01f405a9e3f", "value": "12288:EtU5UrITy1SAEACPCoZoEetJFWycDrclbxFRZmBB/J00tjVyrVek+lFH5kprz:ySAFCPCk4F34cVJI/JdtBmRCFHip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371397, "uuid": "5fe163ab-a6ef-4199-8daf-5736b66f297a", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371397, "uuid": "efb37188-791c-4e72-a9e1-8e36738bf64d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371397, "uuid": "33514d1b-583e-4f9f-b443-eafcc74727f7", "value": "387775ca164b849ef3e6db1658e240e02601ec5036a1accf17026791a51e87cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3026fda5-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786374012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374012, "uuid": "0dda6343-acde-4bce-b0dc-339111049dc7", "comment": "Malware payload (AsyncRAT)", "value": "a74f4a593e04a6f840422168d47a05e6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374012, "uuid": "ca8344ad-f84e-40cb-928f-4df7ead9407e", "comment": "Malware payload (AsyncRAT)", "value": "3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374012, "uuid": "fa0aec7a-95fc-41d9-bb1d-22f2909f0dfc", "comment": "Malware payload (AsyncRAT)", "value": "e7e3e5b4368ed53a934da69fa76d05b200816969", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374012, "uuid": "88582062-9c23-42a4-b4fd-d78e4928b9ed", "comment": "Malware payload (AsyncRAT)", "value": "fc44cf0adf747010baacd73ffcfd0d3cad73f954f1313c9c80193eef5f29c935535ef87b54e05bb157bcccad542763ba", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374012, "uuid": "3ec87b48-db57-49c3-804a-90f3a0ac5c4d", "value": "T11415CF9C355075DFC457CD768AA8AC70EA206C7B831BD20395931AEABA0DA97CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374012, "uuid": "fb825e47-58c7-439d-9bfa-8fdbccd41e03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374012, "uuid": "a574a535-751a-42df-acc2-f78e2b8cce69", "value": "12288:+u5tqgwIWA1vXDfZryvvzKGAe0UaeUBIpBtUoJliXtfn9Afm8zxbfmFE+d5bi+Q4:L5V3WA1vbZue8yqBtUoJluCfm8zxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374012, "uuid": "48237e56-8f4a-4832-abfa-920c014a409d", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374012, "uuid": "767fa3b4-1354-4947-be96-e93faccd5766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374012, "uuid": "816e0c47-cb34-429a-9833-5033bffcb588", "value": "3887395028e30411080d16dc5ebcd884356ce4c3ed056bbf3d1a07053ccdb5c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d44dc58-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373256, "uuid": "08388fd5-65f2-49af-8045-35e19aa73d07", "comment": "Malware payload (Formbook)", "value": "1f5575df0edd58dc0ad1e37f0782dd54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373256, "uuid": "d1ef9d41-611a-4c25-98aa-fad81963c4cb", "comment": "Malware payload (Formbook)", "value": "389693bb8dc83ab540ce9eac5da510d10e1ae85cccc24d95e60d1a3216f6ec3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373256, "uuid": "f37d643c-b873-4916-9770-000f1aeb1771", "comment": "Malware payload (Formbook)", "value": "974e7f07e88e2c2d787d0bbc82322b898e71d66c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373256, "uuid": "269138bb-1d0d-4327-ae82-1f34082576df", "comment": "Malware payload (Formbook)", "value": "46c437411ac3b8136d912a1ff3b4de8509bc4e50881eb108f7df3edf46e4177166d6597f5403883be92b360cbcbb8f44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373256, "uuid": "0a342f3a-c068-4c1d-b325-c855a85a0ad9", "value": "T1B03501441312DE42E4D68BB6BDB1E37432A94DCF78E2D2D25FE92FF734293811958682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373256, "uuid": "937fb0d1-743a-4bae-b71f-00e675e68213", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373256, "uuid": "372db1aa-83f9-4808-89d1-0019e2154c55", "value": "24576:dDp50T1SbPEacomxlbwc8DiqoRTalNOGQfjQhnjWT:5pO1acoSbwc8DiqoElNzQf0hnjWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373256, "uuid": "de65de5b-19e1-480e-8ada-5171f0b22543", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373256, "uuid": "3d4a891e-fb19-47b1-9856-08b4f7106aea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373256, "uuid": "a6f5e510-482e-4270-88a6-c9a32019f59e", "value": "389693bb8dc83ab540ce9eac5da510d10e1ae85cccc24d95e60d1a3216f6ec3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fd4978-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356946, "uuid": "a5c1fedc-05ab-4b9c-a30e-ec504c166442", "comment": "Malware payload (Mirai)", "value": "32e534e36fd962953afbbf0f90d37a1a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356946, "uuid": "3ba144f8-2d96-4e9d-ac8f-b8a6124493a2", "comment": "Malware payload (Mirai)", "value": "3905b82afd6b584b30fa469214c6480e262ad0da6ac5cfbace403331454c4a5a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356946, "uuid": "1e14d24d-0651-4cec-a3dc-265f8481180c", "comment": "Malware payload (Mirai)", "value": "520a7ba97fa31d194914dc39305aa3e58ecdb00e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356946, "uuid": "b3df7e61-e180-408d-a2bb-1cb48f0053e0", "comment": "Malware payload (Mirai)", "value": "3cd2c0d789aa11161cad208f47e1f8beabe95fb280570ce5cddef9a50195639fec04bb8d0ba06b62c99b1e8f54c3d396", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356946, "uuid": "9c22973c-3d3f-4779-b4b7-c3bd4d860f1d", "value": "T178245CC7FC00DDBEF80FF3B6449B090DB570779514536A3663AB79ABAC3A0851922E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356946, "uuid": "003528a1-a106-4c5c-a666-286383cf8ff5", "value": "3072:hwUoFgytXNWIDRe9rXw8zq2y1FtQ6oDlT6tAZN0OV7jbi6LAbRzmmuFVjKHq:9o/9ZUzw8ny1zQ6oDt6gN0sLVHjKHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356946, "uuid": "0fdcd33a-8b85-471d-bfa6-6dec07eddc9a", "value": 218168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356946, "uuid": "493f906d-501e-44b4-991c-10c0d354dfca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356946, "uuid": "e3c6a5d4-a3ce-4935-a077-0083aaee74b1", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc315bc-9502-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786397201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397201, "uuid": "c9447d45-3894-4db5-a746-f19dcebdaba8", "comment": "Malware payload", "value": "0429f6275f4d8bca3b8ac7822fe83592", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397201, "uuid": "0eba5bed-09a6-4a52-97c7-938e9b600f39", "comment": "Malware payload", "value": "39124e4f7013e8ba5c158b4afdb9a73c1df451367cf8b724cc2fea49eaf809ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397201, "uuid": "f1bb4400-15bf-466a-a6ab-25a3586d491b", "comment": "Malware payload", "value": "9142c6eed0c6e955352051581b7eda17b0006241", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397201, "uuid": "b17e1eff-56ea-4e60-af8f-76485caa5065", "comment": "Malware payload", "value": "e90293c70174e943f909777d2e2f5a23b772052ae4c1974e17b8d4bb2ec36eea119db605fdc64832c22b6aacbfe25792", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397201, "uuid": "4e77a1be-df26-487b-8b15-45c6b7c15e9e", "value": "T1EB633A41E653C0B0E19381B009A7F7E64534DF36941BEAE6EB9C3D62FC307828D9662D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397201, "uuid": "769f3203-7795-4f3d-a9fd-4595c858edcc", "value": "768:LWriT9iEfTLQwDQRGAuAnhbcpUEE0M3jT0S+3qPa4G39HvCScStQBxNhtjCZ3ErK:LWr29iEr5DQR7nthrU5dvjtQBPjCZUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786397201, "uuid": "c87d8a59-757c-4f17-b194-53c913281b59", "value": 70440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786397201, "uuid": "986f9850-e3e4-48b2-b52c-3c2ecc3e9cb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397201, "uuid": "c78ae43f-aeb1-4ee9-ab66-2a049fde80b3", "value": "main.x86-i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70edcb5e-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356941, "uuid": "2540f08a-54ae-42c3-a0a3-af81a4814d99", "comment": "Malware payload (Mirai)", "value": "0a10f34b26ebee0bb6e120258cfccc8c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356941, "uuid": "125ebb81-1ef3-42d0-8dc7-45a3079bd4f1", "comment": "Malware payload (Mirai)", "value": "39199d6c565b890e2ebd89a9c0166d931a64cad70080581626856e58f3f48fce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356941, "uuid": "fbd31501-ce5f-4730-8365-f29e260b739c", "comment": "Malware payload (Mirai)", "value": "005b863a21e5e8810fc36ba29a2bdd0eae292167", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356941, "uuid": "9377e8db-a56f-4bef-af52-d16f0e3cb466", "comment": "Malware payload (Mirai)", "value": "b1447e0655a7cce1b4066a9252abba94c30452344194752ab292054a9b7b42cc9e912f88ff1e00797dbe734385553550", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356941, "uuid": "c65136a8-47db-4285-b9e5-243cc3d7a5ce", "value": "T14C142985FC519B12C6C712BBFBAE028D372A17B8D3EE31039D215F25378A95B0E36546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356941, "uuid": "b7c9515c-7343-47ef-90a1-6c9d1bf82f7c", "value": "3072:Hj4fN6aCPMRfTOi2YfKEomAQ8/V3Yu54UV0XTf0Y7tgbP7:Hj40aC0JT1+fmAQY3Yuf0Tr7GbP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356941, "uuid": "0c31b2d8-f4b9-4d7f-b95f-54b2d90e7abb", "value": 195160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356941, "uuid": "2a8c3d63-bec6-4854-974f-ba74c7f2b27e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356941, "uuid": "7000c0c0-3d20-4a18-8eab-5518554a74da", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f252cc41-9461-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786328382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328382, "uuid": "233dfca4-86af-4c68-a7e6-97bbe79d00d8", "comment": "Malware payload (Mirai)", "value": "6b4bc1b21eaab2a3b0fb94dd0d8013ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328382, "uuid": "8047fed9-9602-4198-a17a-8af19664d2f0", "comment": "Malware payload (Mirai)", "value": "3976eda2ae8a095f3868ad94d8b28e8bf3019298a73097a3a124a6f56b687b80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328382, "uuid": "801a22c1-ccb2-4238-8601-073df19c410c", "comment": "Malware payload (Mirai)", "value": "4d371305c419a7639c7524e5ef51bf8b426e92b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328382, "uuid": "77866d08-81f6-4efc-9f45-039a50f42c6b", "comment": "Malware payload (Mirai)", "value": "cbdce36ce8881ca6f32b1e21e4951a5b00e6ce68ba04890dd75f2ca14f168fba2cb7eaefcc0d95e5e041bf89c13bf5d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328382, "uuid": "25810692-cdfd-4e86-9864-ccf579c776c2", "value": "T1C5131BABDE0E3941E3D4E338E7590BE1A02F7934D29680B77E42718DC4ED9DD8D92252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328382, "uuid": "5ecc797f-69af-45f7-b75b-7cafca2d50e5", "value": "768:Zv/i2+QPNW5cKy47DaLs9ykjiA+PfcZplFxLiYBZoCT8la6J:ZvMQVFtKDDyk1+nch+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328382, "uuid": "9c47186d-d6de-4827-8a24-d61b17b6b434", "value": 42048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328382, "uuid": "383ee343-d6fa-4610-b729-53fcfcb0a34c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328382, "uuid": "e54b275c-1396-40a7-a1a0-b9591d4fcf45", "value": "main.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015f71b9-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371357, "uuid": "45f6dd83-a0ea-47a3-91c2-02b4eb98b667", "comment": "Malware payload (Formbook)", "value": "8a003348f92301a8a49ebf51976a86e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371357, "uuid": "5ee26956-1796-41c5-b771-dbcc73f95a73", "comment": "Malware payload (Formbook)", "value": "398cf99253297f4791590cd85876db5e36e6fda316f56c6230306ef0e8d007ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371357, "uuid": "4420a188-73b1-4f03-a2a8-2e879ccdb810", "comment": "Malware payload (Formbook)", "value": "e8af337abd24dc48c11366cdcbbe9a187e100ce4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371357, "uuid": "83eb3cc6-0619-400d-97e2-71ec677a3231", "comment": "Malware payload (Formbook)", "value": "a4fe196fca47dd223cb9ff566c2138922bb7392d0f011441f438cd1e33ad3341a80189246529583060933280046a44b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371357, "uuid": "16039985-6f87-4d7d-819f-597794978f87", "value": "T1D3251288A785CA13C99813394E71F3BA21A96EFAB800D3478FCD9EFF7975D151E08152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371357, "uuid": "f30f8841-cf27-4d6b-94de-3d1c75e05490", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371357, "uuid": "bfd2f500-1780-42b2-8368-6641ca3da374", "value": "24576:LoQzULAoh7KSL0ibrQmW1UuhgVbi3oWCpR:0AYA8K60+W1RceCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371357, "uuid": "a7e4ca77-8cff-41fa-9262-cdcda0b624fa", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371357, "uuid": "1f352b3d-4156-4842-85bd-9506e85c0fdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371357, "uuid": "2fa43805-39bb-4d06-9aec-eed2a70526ee", "value": "398cf99253297f4791590cd85876db5e36e6fda316f56c6230306ef0e8d007ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4badef46-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786370622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370622, "uuid": "0f6727ab-e8bd-48a2-816c-f9e45c731698", "comment": "Malware payload (AgentTesla)", "value": "41a5ff96c0ff85d002f92a20fcb623d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370622, "uuid": "5588e60f-1f4a-4d96-b09f-699bc51d3ec5", "comment": "Malware payload (AgentTesla)", "value": "399e354cc4d22098785ca425fdf1a7a387aafcbdd49c64c026f813a53084bc90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370622, "uuid": "90ac953c-8384-4250-b6de-1cd12716df26", "comment": "Malware payload (AgentTesla)", "value": "28a4334fd4d99c3b678ab2a49c1e54f057924db9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370622, "uuid": "c4cf0ea1-ff00-4d44-b77c-2ee01b65d796", "comment": "Malware payload (AgentTesla)", "value": "9ed92e1e894d7965ac7437ac36ba0210b0284742762250b2167dd4d85ffc01b0063381f97c32965adc22c140bec377ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370622, "uuid": "5e09b0eb-fd99-4991-a44c-f9b406f69376", "value": "T13D64C0A1F2D9C8DAEC51223159BBDC3215576E2DA871591E312F373AADB3393006BD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370622, "uuid": "5de913eb-3449-4ec8-8769-60292008cbc9", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370622, "uuid": "3c33f369-633d-4f26-9b88-20220276b4bd", "value": "6144:ngORaspjQelWMnWR1FsxtcB3UOaZwMAHpbODsjH:ngyjz8R1F8tq3XaZR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370622, "uuid": "2b5cf988-cc82-4512-bf71-a65610be0392", "value": 333080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370622, "uuid": "26fd521d-66f6-485e-b747-bfd09b466c70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370622, "uuid": "5001a38d-fe97-4323-8cfe-44a3da47930f", "value": "399e354cc4d22098785ca425fdf1a7a387aafcbdd49c64c026f813a53084bc90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300c9e26-949d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786353826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353826, "uuid": "6535667d-4822-4bf4-9b44-5262321a3477", "comment": "Malware payload (Mirai)", "value": "64ea8f1e2678b43d19b9ab71843d74de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353826, "uuid": "b9243944-04b7-483a-a605-e5fe7e82e837", "comment": "Malware payload (Mirai)", "value": "39f3387a804707e27cebb905aa0a000deeb7a031d87d69ba22f022238a16e515", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353826, "uuid": "6405741a-bd74-457c-a2bf-2f83b07abff0", "comment": "Malware payload (Mirai)", "value": "f03f9e5009de6bd2bbd10c8c9b44b0438a244c76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353826, "uuid": "46d398b7-0ab4-45e6-bdc4-436afcca637f", "comment": "Malware payload (Mirai)", "value": "dcfe027c17c949cefaec0bde2e3412167443f43d0fe199e94fb32c14d8e9fb1cb0a73daff05307d647e14a31de3da0bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353826, "uuid": "ebef040c-74db-46eb-bb9d-6b01e630752f", "value": "T1A0142B05E6404B53C0D327BAF7CB434A73239B54A7EB73059628ABB43BC679E5F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353826, "uuid": "b58a0652-2a1a-4b9f-bdd3-9792483e9ecb", "value": "3072:enBrwO2vLsNGwJ3eTaEy+CC3KpWTF2E7IK5uFxGHrM/RW6KQejQZGRuM:Kw1okwJuTaEy+CC6cb5ujgrM/RrKoGgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353826, "uuid": "87e1e8e1-b0dc-4757-b162-0cdfa5a0bec9", "value": 194083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353826, "uuid": "bed968e0-537b-4953-a6af-ae1ba6b467f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353826, "uuid": "5aadb4b6-9ff9-4255-9a05-bf58dc54fc8c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f919a58-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383594, "uuid": "617c5bd6-16ca-4a7e-8c16-185aaa0ee4d4", "comment": "Malware payload (Mirai)", "value": "f03b21877f0d7aa7efba2be5a2cb3c2a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383594, "uuid": "b4d1598b-acb9-42a1-b76a-5410ebbef6de", "comment": "Malware payload (Mirai)", "value": "3a6a71f4046b8a5323b9b46229a2373376c8b0092be4ada29c2c518737031de4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383594, "uuid": "afd6ff78-99c1-4f85-8c7d-d976c2a22d94", "comment": "Malware payload (Mirai)", "value": "7612a1735137223df469c7255ff951bdce255540", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383594, "uuid": "9aef5c40-fce9-4ad5-a802-4bc2d89213b4", "comment": "Malware payload (Mirai)", "value": "4635259c0bf17cc518439e98cf108c65ac4f19a7f2f40f0946f54efc51264f730233b5ee572708e83940242580f724df", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383594, "uuid": "a51eac96-1866-4f1e-884c-b4e90b902dab", "value": "T1F3730279A36AEE76DD7698380D9647907552BC0F3D10415B7F8032BCCA78993F286273", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383594, "uuid": "9fac120a-5428-414a-9842-2ee51bb734a1", "value": "1536:fbjVbcml1gfRbWNXgIgoD6zurece2bA+lJl69hhINS+h:XV1eJWaLAiOecfbrZQIsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383594, "uuid": "00ec3933-b97e-4db1-999a-f45d57f93889", "value": 77208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383594, "uuid": "56272d94-7f8c-45a4-a228-4da3f4b34fc9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383594, "uuid": "0bf66d69-20eb-46f2-bfa0-36d7df5c5fe9", "value": "disconnectraw.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc4f74c-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372072, "uuid": "78084172-dbe5-49fa-a769-f4f3ae3d756a", "comment": "Malware payload (AgentTesla)", "value": "7d9c626d3a9cba22a33944fbfe985b7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372072, "uuid": "8f073d45-d9ec-4263-b78f-6dbf68afeff0", "comment": "Malware payload (AgentTesla)", "value": "3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372072, "uuid": "697e6cdc-49a2-44a7-8d32-e297ba6f0892", "comment": "Malware payload (AgentTesla)", "value": "a0fb6244a9ba3f8790e69f1548e09305b45e6318", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372072, "uuid": "9822721f-8631-4e87-9deb-ba72425dce01", "comment": "Malware payload (AgentTesla)", "value": "fd77ce02c31b19cefc4d6a9154994953cd4d1828dffe1369ac469221b4f2d480555fd5edbb47385a43f1ee08994bef4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372072, "uuid": "39691330-f776-46a9-9a22-b20f4082bb74", "value": "T1BAD42351B39484E7D2B209B00E216B375523DF374EAE7B1B8B60796CBD766867C0CB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372072, "uuid": "2cd16180-a84b-42f7-8978-1e3b217a8557", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372072, "uuid": "aabf131a-c2ff-4e44-a0d6-7a8e035f06c7", "value": "12288:gX42de5lr9UsPD1a7xL9ZKQivFj+x++mECjXOszICWnxJidSKi:C42de5lr9UgJcPZKQi5+mECjFzIC8jo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372072, "uuid": "e2e93936-0088-43e2-b287-8e79edcd6535", "value": 623232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372072, "uuid": "5064ae43-913c-4f0f-8668-0e656bad280d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372072, "uuid": "b13b2064-c3c4-40cf-b9d1-9e8fa2ff6716", "value": "3a78488f51a94ad704f9d54a30234491adb708fcf11a9d794dee6f4efef30b09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7adec82-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373461, "uuid": "1693de92-e566-4b51-97d6-0c00b7f95d79", "comment": "Malware payload (Formbook)", "value": "32ca833b299dbd21b7dd7b6e6bc97e2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373461, "uuid": "da719ce1-b98a-4f6e-8740-fe601e0bae0b", "comment": "Malware payload (Formbook)", "value": "3a96f25feefbab52042aa5768020b128bdb7231cb3f8114a01fe23e6c873071d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373461, "uuid": "77650aa2-cca0-4290-9004-7b4a8eba77a7", "comment": "Malware payload (Formbook)", "value": "c06073be75f1c5abe61801c9a26e845be062a17f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373461, "uuid": "e13f0443-4e8b-471f-bc63-6018b29c4657", "comment": "Malware payload (Formbook)", "value": "a643d1dac51187221ab4eec2f2591bee5403f9e334ff5c9f1ab4adb4a16b75f764ae10904d0cffd1a7c1fe656d07e46e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373461, "uuid": "649417af-2ea7-4336-a783-c4943e3f8aea", "value": "T1413501A41346D992E0D287F6B8B0C37472741ECFB9E2C3C69FD96FB7B5293811604692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373461, "uuid": "33dc124f-2942-40f5-923b-6266b7d35f98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373461, "uuid": "f2797ba4-3996-4556-a5df-6f092ef1ecc3", "value": "24576:AZylp50Dp+ZswOlnjqJaQfoBkwqxIqu0P5atuxV5DC:ASpHswOljmaYSkwqxIX0Etu3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373461, "uuid": "73e1ec99-47d5-4d68-b9e2-aaa9ba31f3e4", "value": 1123840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373461, "uuid": "91988763-2de5-43ab-b8cc-04b63518cd49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373461, "uuid": "499863f2-2968-4076-ac3d-c391ee06127e", "value": "3a96f25feefbab52042aa5768020b128bdb7231cb3f8114a01fe23e6c873071d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630e86a9-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786373668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373668, "uuid": "e61c77a2-c701-44b7-968c-bc81eaf2d211", "comment": "Malware payload (PureLogsStealer)", "value": "1afd90b21bf1b66e587dce404b1cdf2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373668, "uuid": "7695e82b-42f9-4b74-bb5a-7ab868ccf783", "comment": "Malware payload (PureLogsStealer)", "value": "3a99c6d83534846f404de72c6f527c964b2235a6b74a8698a688d999c224eba9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373668, "uuid": "a98b02b7-ce49-4168-8b40-e213f0a56738", "comment": "Malware payload (PureLogsStealer)", "value": "f2665ce49a97ad8eec018187fd37fcd0b9d3cd78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373668, "uuid": "659e29c7-dfd3-4c9b-90c5-2cc533437e26", "comment": "Malware payload (PureLogsStealer)", "value": "8562933b478698568f9265ca92dbe027276ab9f2f152a11bdd12ed1f7e7ccd876f87998778e03c77aec70fae41f180f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373668, "uuid": "c9820dd4-782e-493f-b065-e4a56ca628af", "value": "T14605CF2B72928F31C24A5272C1C7890187EA968366A7F71F71C503E61D433FEDA4A6D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373668, "uuid": "818d6d35-429f-4af6-b020-82ff860c7b61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373668, "uuid": "26dafe85-70da-4466-9942-e0b702434fe9", "value": "12288:rq2IPa0sJj8pHHmrqBEgj+mSMGF9lOA3Mp/7OZcHRgh7:rwsJjKHIij+mUFDOae/7OZcHex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373668, "uuid": "81076fad-6457-4a92-b1a3-2906c1fbe8bd", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373668, "uuid": "040039b0-0974-4c96-ad10-665269821502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373668, "uuid": "9767c5af-d025-4963-a8e1-eb1175ed44b0", "value": "3a99c6d83534846f404de72c6f527c964b2235a6b74a8698a688d999c224eba9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260289c7-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373136, "uuid": "4fde59a1-b9cf-4e95-be2e-52f8c5804300", "comment": "Malware payload (AgentTesla)", "value": "27ade9b15e4d61ac546ab57f8cb82982", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373136, "uuid": "b8ffefb6-4d1e-467f-8284-e8dbbd2653b9", "comment": "Malware payload (AgentTesla)", "value": "3aa519838c38d7b056b5cc2da23cd0dc26883b8100414b09942af1885a1aa57c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373136, "uuid": "c7e2b3d2-6a9e-4d3a-a338-1afd46caae01", "comment": "Malware payload (AgentTesla)", "value": "945b94aaa57efe52fab7be0d54c7dd2a4d9be746", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373136, "uuid": "a119dec1-26d6-4d00-a12f-c55676dd80af", "comment": "Malware payload (AgentTesla)", "value": "0f6ed8e27eff3cef3714d1fcce92e0121a146a80ab802b6dbda5ace44e96cacb6db8a2177fd71ddb1f9907d6d0dbf9ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373136, "uuid": "3fbee3b0-f60d-4d2e-bdcf-e321ec296372", "value": "T12425F1142356DE12E1E6CBF6B860D77036B50ECF39E2C2D65EFA6FE7381A3811544682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373136, "uuid": "01638ea0-5e75-41b4-a007-accf94fa9fc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373136, "uuid": "ea670ce8-363f-4432-abaf-4fee5315cc71", "value": "24576:K+p50HS4noeqO5bOfP82pBt/7195buX7IGQNwVtEJdNB1:bp6kcipL/X5bfGTbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373136, "uuid": "f6233495-3027-4a8b-be65-b71da459c0c1", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373136, "uuid": "f4a02a3c-189a-4f25-92ab-b778e9f0f2a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373136, "uuid": "10b6c9d8-95f1-4f0b-a267-78565c42d841", "value": "3aa519838c38d7b056b5cc2da23cd0dc26883b8100414b09942af1885a1aa57c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71ec5f2-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786373809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373809, "uuid": "03e6c88f-ab5d-48eb-b183-e37432354d5a", "comment": "Malware payload (Vidar)", "value": "6953009f18f475899b52cb7fc69a712c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373809, "uuid": "934bad46-01dc-43ba-8c78-fdb7f2c1de01", "comment": "Malware payload (Vidar)", "value": "3aaa4551b2e750fed6432b0fe1120bb945a3a1a91e4a9d08dd33765c60d3554f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373809, "uuid": "88d7e5df-7192-4b93-8606-afe53c319f92", "comment": "Malware payload (Vidar)", "value": "66248570ca9fdb34b56f528924624523fa222452", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373809, "uuid": "8730bf2c-a61e-4477-8643-9734b02ffc91", "comment": "Malware payload (Vidar)", "value": "3f622919ce35f76a907da01f058c0f6b2b4752ba5b65c9d7325d44629ca5c16cccd5b95e736e9e08b9eb4d861a6a6c33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373809, "uuid": "04990a4d-5b85-4c39-bcfe-bed887763262", "value": "T128067C13EC9158F6C099A23189B396427B75BC0D1B3637EB2E60BB782E727D05D3A714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373809, "uuid": "cbdd1eb4-d807-4476-ad39-ddf6fe540b69", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373809, "uuid": "9f67f36a-0423-4c2d-ad4d-9d3d0bbdea8d", "value": "49152:/8qK5fq4XrgI33xb05dxB/hhp0EgrN7OI+rvklR/HCh8dDRY:/iIid0yHoZqRPW8dD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373809, "uuid": "4dc8ac42-fe43-4572-ba23-453d7184a7dc", "value": 3781480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373809, "uuid": "8154722a-fd95-47d4-a253-fe44b530540c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373809, "uuid": "ac7fd5ac-bf0b-4820-8fc7-e9f3f4facf19", "value": "3aaa4551b2e750fed6432b0fe1120bb945a3a1a91e4a9d08dd33765c60d3554f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76c32cf-94ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1786389325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389325, "uuid": "fd783f36-c81a-432c-80f5-12840928c004", "comment": "Malware payload (WannaCry)", "value": "a67c58e1e7613f7ac048929aa0b2fb85", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389325, "uuid": "91ba94fc-beeb-4c58-9cb7-367351c3da9f", "comment": "Malware payload (WannaCry)", "value": "3b4607b7a1a0b179b4f33e798fe7c2cd2c758ae39c22627680299782c18d195e", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389325, "uuid": "ee750cb9-0eca-4771-84b6-0752bf4e56a8", "comment": "Malware payload (WannaCry)", "value": "65d20b4dce3faf273d80d68a6f53eefb68d955cd", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389325, "uuid": "cec01e7c-ecfd-4742-9434-2b98af9c530d", "comment": "Malware payload (WannaCry)", "value": "81cdbcd83f47c248113caa350b75a1da852bba2ea85dbf1f088328544b44156c0ffa67a99d9b9577e19e97e5295c154a", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389325, "uuid": "79aff3d8-a24b-4851-a4f6-b1ae79919d80", "value": "T1E1161219FAD4D0ACC10B1038A56ECA9F73B93C09036A4F2FB6847F156E773459A1AEC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389325, "uuid": "5cd0a34a-a10f-4093-8016-a6d496d20904", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389325, "uuid": "db8c1f39-37da-4438-88e6-293e21a61f39", "value": "49152:jnXnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:DXDqPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786389325, "uuid": "b2a6de90-45d7-4f96-a680-eac96bed03c2", "value": 4032512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786389325, "uuid": "bd4dd7c9-7ec6-4d4f-87d1-e81620025674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389325, "uuid": "f8e1f8c8-fef3-4754-b157-4c2d7afb7133", "value": "3b4607b7a1a0b179b4f33e798fe7c2cd2c758ae39c22627680299782c18d195e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27198e04-9515-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786405350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786405350, "uuid": "335d070f-ab14-4397-9b93-2c3538841610", "comment": "Malware payload", "value": "ad6da42cdfb20da64deeab2d1f59ff85", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786405350, "uuid": "4ff4abb7-142d-4d73-b16e-3da885de8f45", "comment": "Malware payload", "value": "3b842c26338a3e6c1c76f358f7df3876b1a71f211cb8e5294ae8e1471d0aa526", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786405350, "uuid": "55a92600-1e48-4495-a06d-fe7aa67bfde5", "comment": "Malware payload", "value": "c202078a43ec5a0fde713077acd259abfae5d284", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786405350, "uuid": "6ff3c3be-9c41-4caf-9063-ab659796d7f3", "comment": "Malware payload", "value": "dc4a2df85b3bc853299276be3707c1632087504025b4b38e417bfb39c5a3b47e468de445373714e8af52fe109632be6e", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB3.file", "colour": "#87A90D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786405350, "uuid": "c337ec19-bd91-4fdc-884f-7413570b7016", "value": "T1129412A1DE7541FDC01DF1B0172A2299D8F1F0818F5822DF6B286271AB70EEC6B7CA55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786405350, "uuid": "d2bd3306-3877-4a20-91e0-5c3afcba59cd", "value": "b93bf499ed2f500909ebf8f70559e1b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786405350, "uuid": "1176d8cd-0c36-47e4-8526-54d47fb0a4aa", "value": "12288:5/0IdBI/e98XO920iSIBRimORzRtwXUVVzmhR8F:p0Idu/qDaSIXim2zb/Tc8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786405350, "uuid": "b7fc316d-6f02-4057-8679-2f3ac6b7c6ed", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786405350, "uuid": "9583a363-bdb2-4fdf-a72c-0e8535c67669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786405350, "uuid": "314fb65c-786c-453d-a6de-80b99ccf3372", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4af81a-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786383594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383594, "uuid": "00d3da40-bf07-4730-af0d-69674b698355", "comment": "Malware payload", "value": "12ef1d1433bbcf5e116f58a4907cc671", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383594, "uuid": "c3a982b0-76c5-4810-bd3e-2620278a07e5", "comment": "Malware payload", "value": "3b8d687bbfec3302f53530f0db2adc7926905eb4cb11512a9e6fcb3a8f623aeb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383594, "uuid": "5dc148c0-8e8d-49cf-ad29-38da1a950c4e", "comment": "Malware payload", "value": "dcbe641ff1b8b652fd8e6426818b559a3c5fd85b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383594, "uuid": "48dcc0ff-b6a5-4b15-90ea-863397920d09", "comment": "Malware payload", "value": "5c387890160830fa2703ebf3b40a7a1a1d441139fa048bd01c029b34a817eaecfa0220591de6f80315361b1903fa2e17", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383594, "uuid": "8331033e-0d0b-4cb6-b8aa-5e63b9a34196", "value": "T187E0EC5925926FB7462DCF0FB07A4B395046B194D0EB76A86C0BBC3DB598609F40BB0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383594, "uuid": "99ebb42d-1390-4f8f-bba3-9e265adf8b1c", "value": "6:hZAUvtlvtfV2ICFRcUvtmI1EfMvtmIU3eFay3eFKXiJX4iv:+I9I+/IW8X2Xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383594, "uuid": "8163ea4c-68da-486e-a606-e471b5ebb3e1", "value": 326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383594, "uuid": "7744e8f8-7756-45fb-ab3a-6fbd8652cff2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383594, "uuid": "e7e90d43-6323-4ed1-ace7-baa3335058d5", "value": "k.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbc2d32-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339914, "uuid": "bfccd154-53a5-41c7-aab6-552d61fc29de", "comment": "Malware payload (Mirai)", "value": "64513b17b75f1afd1bc48c8dcf40ece6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339914, "uuid": "9461bc9d-a903-448e-a284-11db3f533928", "comment": "Malware payload (Mirai)", "value": "3be64adb8e28c8c263f8d351a19c294f92364c924f6bde62337a213ef4da5323", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339914, "uuid": "182e3ba0-5c86-417b-8f41-f1d4d1c85baa", "comment": "Malware payload (Mirai)", "value": "27f9cbc52371309af974266ca2eab1543577edee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339914, "uuid": "ee047954-09c2-4f85-b953-40012f5477ee", "comment": "Malware payload (Mirai)", "value": "d546953a05c9340088f24da1794248e32698ca6a995101465a07ac054cea04d09539867c28fcd1cd086213dcf53d2127", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339914, "uuid": "f635ea46-5997-45b0-9582-50ed3a2c9c94", "value": "T1C1742A4872F1E2DDE158EA745316BC279D71553730A3728B339EBA7327B70804AEDA21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339914, "uuid": "3cc8a58e-b336-485f-ab86-9ba602ac7676", "value": "6144:fa90a9ja9wCpEifC+twbKAI0QAYgLnQDFC0Ppll:fa90a9ja9w0CJ0SQhCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339914, "uuid": "6d7504b2-3891-4afe-a340-35883af79114", "value": 359320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339914, "uuid": "20fbe083-62b2-484a-9818-9242924cc8e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339914, "uuid": "bfc87c36-c71a-4887-8bfe-03bf769047b0", "value": "x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c1b315-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786371409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371409, "uuid": "94f829c2-1b9b-4e81-aa37-ca262ec3e830", "comment": "Malware payload (RemcosRAT)", "value": "ed552e44a88690a9e313d72850416359", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371409, "uuid": "7d11d493-801c-4849-9666-917b24716c7d", "comment": "Malware payload (RemcosRAT)", "value": "3ccb005c80531d21f8cfdf7823f55b16a55fc83a8b05935224b89f3aaa4e6320", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371409, "uuid": "818b4755-d003-4e29-8a6b-612dfd78ab8e", "comment": "Malware payload (RemcosRAT)", "value": "0e9a9aadcd5485ddd352f3e5194eb13b3fe8bb65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371409, "uuid": "55cec5cb-d066-4b65-8f9b-fd27e2908cb0", "comment": "Malware payload (RemcosRAT)", "value": "70cabae4cd61ff3b29ae109b01184de2ddd209e6df851e23f3601d67b00f3ff2fead88bf1069aa981433b7f0618158c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371409, "uuid": "8b8ef9a1-6f36-4071-882b-68c15b6d5705", "value": "T178551258DB05E102C88617790AB2F3B542696DB9B811E707AFDA7FFBBEF8D101D04192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371409, "uuid": "6ec1e7a7-995a-4e64-9e1c-7842df2bd537", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371409, "uuid": "a3bd9d41-e0a6-4e2b-848c-ef292e8cdb9a", "value": "24576:7AUfaFK0E0Ot4kmB5GohfjnSFJWb4GYka5qjLH3P:cUiFK0C4R5GohbnSFsb4HmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371409, "uuid": "ee7682bf-6526-4f20-bfa1-2a7489cd8fc1", "value": 1286144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371409, "uuid": "49396d41-5ff5-40df-9373-94fabec27c4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371409, "uuid": "5265c127-c8c4-44bb-a1a5-cd4a3ddea5fc", "value": "3ccb005c80531d21f8cfdf7823f55b16a55fc83a8b05935224b89f3aaa4e6320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3367d04-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786372085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372085, "uuid": "64105f8f-a4a9-4d15-a578-33b550a03fed", "comment": "Malware payload (Vidar)", "value": "083ebe6a81aaba44b4d1f56eebd51e1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372085, "uuid": "25ed643f-5a8f-48b2-ac4d-e97137b70b90", "comment": "Malware payload (Vidar)", "value": "3d2969f2e116e37326ef25efe70721d27cc39081bcf8e850dc4c9dd53b1a13a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372085, "uuid": "01f1a069-321f-427b-9fe8-974b2e71bc7a", "comment": "Malware payload (Vidar)", "value": "7630391990cd359508b797a9adc07ffd1ad88be7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372085, "uuid": "063789bb-8dd1-45a6-a033-4219ccfa9152", "comment": "Malware payload (Vidar)", "value": "6da09ad7d91ddabdcc15532b8d7ecb7eac6ba9bf324a99560c9b17b6af6a207fe533d534d0b0f1bd7ff543efbebae4dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372085, "uuid": "b0eebd26-870f-472d-b395-0ee48bb48388", "value": "T1C6422886B295D0FCC1BBC274F8AE10E7DA66304603164DFF73A594402BD2254367EABE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372085, "uuid": "11f8a277-fe78-437e-98ba-6052da985125", "value": "f6372b356b11b44f58d86bbbe9d55263", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372085, "uuid": "33ea7772-3c72-48f7-9fd8-c6e95c329dc8", "value": "192:1FyfdJz6vf9wimidl4kZv0Ysgl88/E8PGn4vzmPD0vU5c1n1OV3VwCWj:0MTmwP88/E8PG46PNJlwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372085, "uuid": "5badf791-6e11-416f-b472-76a1200b657e", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372085, "uuid": "0bb17ecc-1c1f-47b8-b3a4-d52a9ac945cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372085, "uuid": "37f2ab12-45e0-45d2-8e5b-268a6cca09e7", "value": "3d2969f2e116e37326ef25efe70721d27cc39081bcf8e850dc4c9dd53b1a13a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f75c9e3-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368508, "uuid": "380e5876-7444-4ba0-98bd-5eba1245b946", "comment": "Malware payload (Formbook)", "value": "16300b8f89700f85643b3b3d6b13e86a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368508, "uuid": "34852508-aed7-44d0-9116-02a635044e7f", "comment": "Malware payload (Formbook)", "value": "3d87a298c1dcb34d5fd1221ef3991d138ea4708df1597ae32983a1883405a6d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368508, "uuid": "5eee8e17-7127-45ad-aac4-e70ed42afb00", "comment": "Malware payload (Formbook)", "value": "f5c1b43c73cf3ce4599c6b7c98f9280013931bf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368508, "uuid": "024fe724-e2bb-4a6d-9c33-25ee5e31a891", "comment": "Malware payload (Formbook)", "value": "fec2b359800780fdab06892a5c50d7f4e88c8c644877a28d1cd3a97161e88977e135f68fbd5952dedbb9dbf875720eb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368508, "uuid": "260371e0-6bc0-463d-9710-a3f1c8647f2b", "value": "T1B83512D43B29B719DE6045349939EDF902FA2DA4B024FAF61ADD3B4B79AD2009D0CF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368508, "uuid": "7d3c68e9-3736-4d64-83e2-7ae576ce7b93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368508, "uuid": "fbdec4d9-5798-4a06-a42d-f3915293e9d2", "value": "24576:Z1B62QIxj0yogETxhA5S6xwju+p74aNIuMeoe911qtaCkRdEkawG1:ZeG03A5S6wRp7hC08Lki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368508, "uuid": "2dbfc3e2-c5f9-4528-9a90-a3dae61c6e61", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368508, "uuid": "429d1163-6e8a-441d-9df5-70dd2dd0478f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368508, "uuid": "df4d17b7-29c4-4d30-9371-252cb94659cd", "value": "3d87a298c1dcb34d5fd1221ef3991d138ea4708df1597ae32983a1883405a6d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e87950f-9466-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786330308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330308, "uuid": "a743e489-b729-462f-ad69-5be5a0cf2eff", "comment": "Malware payload (Mirai)", "value": "9cacc84da036a04955a69ec61d337943", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330308, "uuid": "610b48c6-9279-4826-80fe-549b6cbc46e5", "comment": "Malware payload (Mirai)", "value": "3d9b27a3bf639f2e626b3b8dda083f263e1c0cf1e57bccb7a5ff40e8ff3b8191", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330308, "uuid": "a2cedef7-c65c-4a80-8df8-f6d3497bf944", "comment": "Malware payload (Mirai)", "value": "0c43cfce829011713ba93e4a7d3b7a41eb57324e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330308, "uuid": "26591506-e6da-4c81-b152-b924bd0b9421", "comment": "Malware payload (Mirai)", "value": "2da831bedf63c4234c72104cd0f084fd55cd6083a568fd08c2aeabdcc23821d836ca2505065866b3830268442e0e8990", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330308, "uuid": "05b76ce3-a172-4b37-ba78-2571ba3feb94", "value": "T12043F232D19B3658A3D01C3FDE7D0D87608732B646B627C41A3B011DBE5278F9D698A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330308, "uuid": "c34079b4-e1e7-4e15-ac3d-0150eb9152f3", "value": "768:QjO6tY3QKoPlyzOwUwvjK83k25vY3M+5+fob402y+Nz4Pq3UIFrEUnnIxJ8632Sa:T6GtoNGvWOY8/fBfy+Ncgp1d6TMXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786330308, "uuid": "401ef02f-9f94-4e2d-af71-10ed4beec739", "value": 58312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786330308, "uuid": "81849266-c0fa-418f-8d9f-08f684648b95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330308, "uuid": "a910a627-1101-41c3-a2bf-97484f078bdd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316b4550-946b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786332353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332353, "uuid": "f906041f-75fb-4961-bbc4-9e08585d6aa5", "comment": "Malware payload", "value": "947fab6ba35bb555f592084cf445ed8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332353, "uuid": "831214e5-a464-4a7e-95f9-ff9ac755d1e2", "comment": "Malware payload", "value": "3dc20f151904e6a4b389076036cde9c1b87068796e28c030ed67e03bbc046cc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332353, "uuid": "72cad6f5-12a0-4d5b-9f62-5e37e43a8650", "comment": "Malware payload", "value": "6bdc9d229f9e3394b0de882adb34cac33e1e23f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332353, "uuid": "df80af34-ae93-427c-b37d-275c048f117e", "comment": "Malware payload", "value": "88cb1d788f95825785e381255daa90d442602e46feaa4b0964308b8802b6f0f1e5a24391636d1a4367d5fec90634751f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332353, "uuid": "c17b0b50-ec19-4124-96b4-c98c1934f8b8", "value": "T1DD53D50F7C1E8AB2CA929634C63F00511655CB5154BB9F323ABAD61DDBB212BD31BDC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332353, "uuid": "76cdd5b5-ca56-46b6-9ab3-cb5d849b5db4", "value": "768:tyknCuoJVldwMbRiQx9fw3kagMCx1ImPXm9I52jqjl3UeO9BTv:tykCVI0iQx9HMCx1ff52jqjRfO9BTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786332353, "uuid": "2ff082fb-6917-4cf4-b6f9-525cb9a13686", "value": 62124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786332353, "uuid": "18a9e6f9-5c2a-4efd-8f84-1f7cce536df3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332353, "uuid": "9cf4d21f-e2cf-4574-998c-1ee212639aef", "value": "main.microblazeel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38be74a-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368247, "uuid": "3037487e-b9a7-4a6e-af06-fafd00632d33", "comment": "Malware payload (Vidar)", "value": "777eb9000d1e315eebbc0a5af2b021ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368247, "uuid": "b428761f-72fa-43e5-8cad-a1054d7ff3b5", "comment": "Malware payload (Vidar)", "value": "3de3efb60114bd192d2454a66f8089403dc2736379bccabb5cdac86e4ec702c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368247, "uuid": "070ea13c-aeea-45e8-b567-ad384d11ec78", "comment": "Malware payload (Vidar)", "value": "7b741466a5aaebc15952864eeb4891ae68686e2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368247, "uuid": "4750bbd6-6894-4110-9d43-e1f5e3de0ff5", "comment": "Malware payload (Vidar)", "value": "935244a823dd4562a4ddd0a692a6fde88a680ae6ffe24252622ce51566714c2cf7a6157128cbd0e60bbe3a9d9c40dab7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368247, "uuid": "cc4b2ed9-2ef3-4585-91cd-b6a4cb5d73f6", "value": "T1E9923E45D11BAAE1C0D6C337A35952A325FCBD242135AB3B9BEC677A4D52330E7802ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368247, "uuid": "df0c2744-e30a-4565-9f99-6a4951cb4764", "value": "25141296cd904157b75686c0bdb5f4b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368247, "uuid": "dc917497-2a2c-4b5b-a63f-7d10783d7650", "value": "384:OL/eq4mQpd/ZmZTHN3BRl+a6j/HjkBL8l/:yeHzwHNMVbmG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368247, "uuid": "7f21dfaf-a905-4421-901f-2e7ba666c53a", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368247, "uuid": "fd64e7cf-6c91-434a-9fb0-32e457fa482b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368247, "uuid": "7620b547-dd6c-4e7b-8232-4f7b16b1afd6", "value": "3de3efb60114bd192d2454a66f8089403dc2736379bccabb5cdac86e4ec702c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb13a5c-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786373924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373924, "uuid": "8a85ef3e-bb13-4661-bd2f-8bbc54fd107a", "comment": "Malware payload (RemcosRAT)", "value": "ec6fa8fa986e0217167226bc3e83129a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373924, "uuid": "bf251d09-0916-4572-9aa7-8e3310b9851a", "comment": "Malware payload (RemcosRAT)", "value": "3e84649105f44d63fe758c2336dce709f48419b77ef9d501cf1f724b55e072fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373924, "uuid": "019bd380-80ef-47a5-93c9-97671011ce48", "comment": "Malware payload (RemcosRAT)", "value": "4ccd8e8893cca38d86056bcb53c9ba3bd8caf422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373924, "uuid": "2f50bb5d-6cc8-4b31-80ca-676d5d1a90f8", "comment": "Malware payload (RemcosRAT)", "value": "43e8b8262b66c4d5ac66e720ba7b66b7682ca3568196ed7989b5abb5c3343180266136959983c82e88487836c207fd53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373924, "uuid": "af4237fa-4572-4fb7-b61e-5ae05a2685e7", "value": "T1E64523942B604722EA3B5BF80436D17243B51DADEA31D35A1FDE6CDF3A87720486172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373924, "uuid": "f48a24f8-1307-4a48-95f0-eadeba26e35e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373924, "uuid": "a97e5aff-1831-48ec-9cda-e6c6d1356833", "value": "24576:MNesHAPJHFt5JKsxjihm6VUYenPN3ud520bEQwoAxu6CB:qnARn5Esx6zVRePN3g5B/bAxtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373924, "uuid": "5952ee43-5869-4dae-b3ba-32f375387441", "value": 1272832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373924, "uuid": "5882af5d-6dd0-48fa-8930-6583bc28300b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373924, "uuid": "69941136-e875-4968-8b95-d67d41fadd8b", "value": "3e84649105f44d63fe758c2336dce709f48419b77ef9d501cf1f724b55e072fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42106466-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372754, "uuid": "79f3d6e2-88e0-427e-8c2a-a64c9590648b", "comment": "Malware payload (AgentTesla)", "value": "6772cbf8d7b955a15c50527469d6c213", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372754, "uuid": "c787957f-9501-45aa-90c9-34f605bac46a", "comment": "Malware payload (AgentTesla)", "value": "3f082f15d30f7d14127e9235c2cd0d5c231cff9aa31970c31eb05c6cf6076b8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372754, "uuid": "42ec2dc4-33da-4178-9b90-237feb1fa315", "comment": "Malware payload (AgentTesla)", "value": "7a32627c5fe0c9795fc536f1c493fe984a3a3c05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372754, "uuid": "ae54d4e7-f220-4af4-86a7-2556c2739e2b", "comment": "Malware payload (AgentTesla)", "value": "7451b460718135b320abea8f3ed355230121dafee1e9b125bc4deb972bc9ff3317f56070a451ed42e3a89663fa0123e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372754, "uuid": "d4746729-ae24-4285-b92e-2cd03238d8fd", "value": "T1D555CF983212B88EC487CA72DCA4DD7462506DAF6797C20355D73FABB93D6839F140E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372754, "uuid": "f8c048dc-b214-49f2-9381-3e1d334eb401", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372754, "uuid": "a3e06945-0f11-4ff0-9e55-d1a97ea1c543", "value": "24576:lep50Prvg5+6lQL+hgNOK8pkEKTb1VBtKP/STWhY:spWuFiQgIPUXum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372754, "uuid": "8166b5c6-355a-49dc-a8d1-9b600bd8576a", "value": 1312768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372754, "uuid": "12d3b0a7-f8f4-4050-9625-c376d7500f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372754, "uuid": "907f1795-18a0-4941-b195-216d7b260291", "value": "3f082f15d30f7d14127e9235c2cd0d5c231cff9aa31970c31eb05c6cf6076b8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25a8a5b-950f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786403007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786403007, "uuid": "2e6aa824-c44b-4710-80ec-927d69528eb5", "comment": "Malware payload", "value": "2ca1a863f6a115127d623d3d181ab9b4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786403007, "uuid": "c3113d94-b07e-4b5b-851c-5f8290b0cc63", "comment": "Malware payload", "value": "3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786403007, "uuid": "c31a5c10-5e12-4c17-94fe-91432f57f5e2", "comment": "Malware payload", "value": "58c15d76520685b6c151cd48b09375bb94b825be", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786403007, "uuid": "56723254-ff7e-4994-bd7b-c6664ab969ad", "comment": "Malware payload", "value": "cdd8c85c79ae614e7cbd464d3a427ae2a1e818378a5a7845895c14abeaef283e15fbff2b42c1175d78239a98e23740d6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786403007, "uuid": "71749992-5488-46ba-afdd-61212b3273d5", "value": "T1AB21BE8EABA1ED3120D9D528B7F2493E5E62F29A2C107411358631FCE4DC62032EDC7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786403007, "uuid": "2364d744-e500-4adc-a477-4665d2349eb7", "value": "24:M1jvF3SbinrGx1wyx1eC2uK6MTzaH+2TMTSIAvF2b2m2p4nKTNXT5eORv:KSbinrS1wO1F2uK6MTu+2TMTSIfy3dAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786403007, "uuid": "1d50c83e-e455-4fa5-998d-dc1d2c1225a0", "value": 1157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786403007, "uuid": "5ed77c21-4fc5-4545-9bf7-1ff0f792d84c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786403007, "uuid": "bfbbe26f-16fe-4be9-80b5-5d299a74f1b6", "value": "3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509078de-94fc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786394682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394682, "uuid": "ac720068-42fb-4a61-8182-4a130babdbe9", "comment": "Malware payload", "value": "86bb26cd21214a1d9c4f22871ee4f9be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394682, "uuid": "2b7ebb66-7ead-42df-aa12-0246bcb1a802", "comment": "Malware payload", "value": "3f92691679255d80261e1574ff177ac0dc88de66fb1b3dc08023a85ac4e389fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394682, "uuid": "86d4bcdc-1a4c-4829-b219-aaea1531adab", "comment": "Malware payload", "value": "5518360819b6d30af0c0f892a96f42cf09e7ebe0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394682, "uuid": "357097ef-9c8e-466d-b171-a0f2cfc16df1", "comment": "Malware payload", "value": "f008d8662d1d3576a776b77f1021a60d5d5359ed3c5059d506712e7c6dd9339047e0fca6863f9822ffb2c63573d9b76f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394682, "uuid": "f4e0e0dc-51ab-4da2-b092-da398b135bec", "value": "T171D33B17FB0C0562C8C36DF80E3F07E683249D5220FED615651D7EAA1B32E719687B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394682, "uuid": "431e77a1-a1b9-4b31-83e3-e29404f3d159", "value": "3072:/3s4Dn8p2Xg3yVaFOT+cyA9egTQNt5sz8MaPUqu:/s4Dne2XVVaFOT+cyA4tmz8wR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786394682, "uuid": "6857d518-c7be-4952-ba09-8ba558aca580", "value": 131984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786394682, "uuid": "113c73f0-a479-442c-a857-2a8e8f809ae1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394682, "uuid": "3e4109d2-c88a-4a85-8c90-c7b9941a8f9d", "value": "main.e300c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08152d0-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368215, "uuid": "51369c7f-e10d-4b7c-bb8a-ee2041276584", "comment": "Malware payload", "value": "b57e721c9b1ca921b911c74aeb4aad09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368215, "uuid": "42be1b0b-f5b4-4fc7-a91b-91bb6f475094", "comment": "Malware payload", "value": "401b42c6795e9103e4eb4eb6647fe49d7b225701fc0ff372e5508cd8c291e093", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368215, "uuid": "4092915c-2785-487d-abd4-c0a880811522", "comment": "Malware payload", "value": "9567e85551c25538fac2bd8ecde88a4096178983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368215, "uuid": "b77f714f-27b6-4c3e-a46b-c5c1e611504a", "comment": "Malware payload", "value": "69a905c66c1ea227b91a6e615ff7aa710e1b9bee7c01094c21c2c306870fd034dcebb4ba2b5ea1e7157adcd67180837b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368215, "uuid": "42a4546f-beb8-4015-b061-ddbce3006aa3", "value": "T15D83E1B3F2E66C80C6AE32741453F8D110BAD44BEF379BB996CC18896F01714EB61B85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368215, "uuid": "215a97a1-4df1-4ed0-82d8-a2efb165dc29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368215, "uuid": "926eb0f5-7dbf-487d-8745-a1465ffb7570", "value": "1536:47beYhvSVxoOmKhkAjokUTt+804/7NZ1qQXp/tPkM3tsoGDPud2qDD7j7OaTeTk:47bDUVxoOZhDjtgb/7NZwkp/tPd9n/D/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368215, "uuid": "066026da-869a-42d5-992e-57862502c01d", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368215, "uuid": "bc43c050-e04a-4e35-acf8-201292b2bbc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368215, "uuid": "604f06bc-4795-4a81-b207-396ee9365cea", "value": "401b42c6795e9103e4eb4eb6647fe49d7b225701fc0ff372e5508cd8c291e093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0c56db-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786371108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371108, "uuid": "2624c095-e692-494a-8fcf-4153877ffd00", "comment": "Malware payload", "value": "59c149a9e2e27f4c672cb32f0fa01d52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371108, "uuid": "f8355254-4a3f-467b-a775-7ef2bf1f5f86", "comment": "Malware payload", "value": "40273c04c5176e7867cf29f34fb6e33182027b66e8de8fa449fb5efb5c0d2dba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371108, "uuid": "3d89e07e-624b-4b50-9043-1e4fbfa0023a", "comment": "Malware payload", "value": "e3f4c8edc09dbde67555ce631b4ecb1c4630d9af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371108, "uuid": "3e144622-3c0e-44a7-96b1-ece8b4945c50", "comment": "Malware payload", "value": "9c00c65322b709e77c45a390649ae406b96acb64c17a9096d37c1d06e648545f66b93ac07d1db7dcbc4022b6f550de81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371108, "uuid": "7950adaf-1689-402d-be1c-f5131a4b1c70", "value": "T10D75F1112DC32264C76B0B34C129449C67F49E4742D5E6AE2EE962FFDAF274EC8160B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371108, "uuid": "be58066c-97a6-4bcf-be3f-95fae9894992", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371108, "uuid": "bea57529-edd1-4d37-b001-05a8d4869757", "value": "24576:eVClKm1Z/rM655yJmg6K4lZGwo9usMAPz8C2vNOFQ+VH:eVCvZ46OJmg94PGWxFSQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371108, "uuid": "70437567-4000-45be-88f7-cdfac346de26", "value": 1654784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371108, "uuid": "2d260001-4689-4804-bb6a-80c2d83d2d17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371108, "uuid": "511d642e-5a0c-46c6-94e5-bdebe0892f0b", "value": "40273c04c5176e7867cf29f34fb6e33182027b66e8de8fa449fb5efb5c0d2dba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6505872f-94f0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786389563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389563, "uuid": "8aed21c2-7a55-4b6b-ac48-41b1bc23f218", "comment": "Malware payload (Mirai)", "value": "517aae584c84ae62f9ceac831db6e2cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389563, "uuid": "2fce3b7a-0fa6-4686-ba34-ced860adc199", "comment": "Malware payload (Mirai)", "value": "406d2eb4deac2f4577ab528be46b78f90a87c7e5b08b070172dedda263999cb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389563, "uuid": "43caae11-a136-42a9-99dd-f475e1a47c13", "comment": "Malware payload (Mirai)", "value": "7408213e335f66494564101c4bbd709dc4eb0276", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389563, "uuid": "72e684bf-b6af-430d-87ac-80b93074566c", "comment": "Malware payload (Mirai)", "value": "3185a1d9277d8fdf4888bed0cd01e1ebcf148f14724436d5a5f4546cec2adba843023bccd16522686bc7f6b5913ef1b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389563, "uuid": "67721fce-ce96-4edf-b991-d8e7194c1e56", "value": "T13BD34AA3CC2A6F5CC224E5B4B0B49F795B539921808B6FBE1577C2748083D8DF6493B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389563, "uuid": "779ab5b7-8ce7-4877-971c-2218130b2c42", "value": "3072:f/ysKkgV5nqVTccn0jM1JaZeiN4W2ZW/k6TseHz/:XyHtV5qVTccnj4h2Zy4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786389563, "uuid": "fbecf871-a6fc-4be9-be2e-b29e96a4c267", "value": 130296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786389563, "uuid": "7195afc3-48ae-4500-988f-34104a31ed9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389563, "uuid": "93659d00-a2af-461a-ba65-87928fee052a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4e42cc-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369150, "uuid": "ae95b4d4-0860-47db-bc94-60f458d135ba", "comment": "Malware payload (Formbook)", "value": "b795dc02fab37a4f0ff448f7cea827bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369150, "uuid": "63c22a9d-0935-495c-9992-c72ab675ab98", "comment": "Malware payload (Formbook)", "value": "4093e8851281fe4ae5074a27e5e5c4906e31440aa5875b55403bb3d5cf096199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369150, "uuid": "6ea02e2f-f779-4a83-a98e-28622062d4bb", "comment": "Malware payload (Formbook)", "value": "cf08feecadde7056e9a8f331c79d095919d9bfb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369150, "uuid": "833a6d54-360c-4167-b75c-4c2c70981607", "comment": "Malware payload (Formbook)", "value": "994d533f77845febecec469875f8b0f482995f94d97aafc70228de8c6436eec15bd1350ac6e10c19e57d780af80bdc7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369150, "uuid": "2887e8e6-bb6e-42c6-805c-41dceb1e09c0", "value": "T1A335010022A5CE06D1BB1BB02DB1D27057B87E96E962D3074EF6ACFB7D7A7121815393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369150, "uuid": "bd885d45-1b48-4db6-999c-561a8fdb3bb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369150, "uuid": "8dbca5d9-849c-446a-90c5-6d04d92902f9", "value": "24576:vNZkYeJa8OxH1yJEvo56ahZPLeit8W+sdPpZqmR7HapEfRL:VZgIaDHt8WpH/xa2fRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369150, "uuid": "90c6b08f-b454-4376-813f-02757b0c4836", "value": 1128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369150, "uuid": "09f953bd-21a3-4d25-80b2-17736a7013ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369150, "uuid": "534686d0-c67e-4644-8a21-2d3aa21c636e", "value": "4093e8851281fe4ae5074a27e5e5c4906e31440aa5875b55403bb3d5cf096199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805c1016-9486-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786344082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344082, "uuid": "475b4e85-0184-4c61-baf4-d74f991e54c3", "comment": "Malware payload (Mirai)", "value": "125fb6fa9abce626be03ab346cdc146f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344082, "uuid": "2cffd4e0-5175-40c0-9f3c-e01e4663b0b9", "comment": "Malware payload (Mirai)", "value": "40a9190f3f5a0f86f97065f09d071b5622517729b6b81442afdc408ae8ec9330", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344082, "uuid": "ed172064-8dec-46fb-b6d5-3dbeb1bb43d5", "comment": "Malware payload (Mirai)", "value": "a9930517def979ee28e30ba1095b3335c476134f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344082, "uuid": "b091f16d-72ec-4524-a391-b739f89030bc", "comment": "Malware payload (Mirai)", "value": "a277b6f9cc5be9cbb33213533a8c901d1cd09ba60d385fe697d90d6b3f99227e8a7e5bb4f1dd2438345e4fb2e31861db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344082, "uuid": "743214a1-1cc0-4763-a8b0-d172ab39c5c2", "value": "T1C4031B46EA519B09C6D272BEFB8E014E37176FA8E3ED32359E306FE013825E70935525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344082, "uuid": "138d3479-2a7b-455f-b522-ecfef8c45d53", "value": "768:MknfZ7W0BFWJpzunYeNLDvm9pJ5M8Leio6hg+wd9SaVjH9yh:Mknf9VBFWJpSY2SjDMTio6e+wdR9yh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786344082, "uuid": "bd127279-3d78-4a1a-93bf-a53f6e237f90", "value": 41128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786344082, "uuid": "b4cde124-0169-418c-b6ff-de65cef63dde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344082, "uuid": "1d148731-f24f-4276-8c73-8154691ba312", "value": "main.armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961efe3d-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368170, "uuid": "1da3cd38-b848-4f04-b834-340f5a6c8bd6", "comment": "Malware payload (Formbook)", "value": "670907efc31b8887b15784879d7f50be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368170, "uuid": "e496c3fe-03cd-4ad1-84d6-991c1d6e8768", "comment": "Malware payload (Formbook)", "value": "411c1c6c545c60db98816e9c73cc7232332688fdd83a10958120f5d8ecacddcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368170, "uuid": "c5ed25e2-313d-40dd-af77-d772a513309d", "comment": "Malware payload (Formbook)", "value": "e9f63e64b4886277b135f2e59e38377d86fd9d9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368170, "uuid": "742fc433-33b5-489b-8afa-fee342276bf4", "comment": "Malware payload (Formbook)", "value": "a615ebc5157664da47f5bcfb722ecbe648572a41b8b499a53cbadd8c065a88d704eb1df7d35de6eb20100fa70ca13682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368170, "uuid": "a9adc813-d892-45d4-b35d-b972558c3587", "value": "T198D402284BA4DE15D1FF67BCE069490443B59187AA87F38A0BC9B4E32C3B325CD455AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368170, "uuid": "fc04a029-3071-41d6-b91a-6b09372ded12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368170, "uuid": "74889627-2657-4add-815b-a402916ac036", "value": "12288:5Id97yIGbDWCrnY7SN7obxxucLXl4voy22:5IdhyIY9CFmcLVWoj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368170, "uuid": "729d0ee4-ea92-4fae-a86d-e7f9a256c342", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368170, "uuid": "6ee6bdc7-25d3-4e44-a3f6-b87e422f6490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368170, "uuid": "9858d6a5-4435-441f-8359-204d2cc61b60", "value": "411c1c6c545c60db98816e9c73cc7232332688fdd83a10958120f5d8ecacddcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bb17e8-94d2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786376793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376793, "uuid": "b552e587-7d1f-48fe-a6f0-93cdaa609bb6", "comment": "Malware payload", "value": "ad73efed9af505413cf3f11ec0174488", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376793, "uuid": "a48f46ec-e5ce-4d3e-874c-20ea5cd99d64", "comment": "Malware payload", "value": "4127e9f40372f891de46f404ad4662a88ab147bdda43b0dfd6bcba0a929f84e3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376793, "uuid": "772d2222-8846-4eb6-bdd9-66413ccbfd52", "comment": "Malware payload", "value": "f5c2b72272ff30ef25d95dd4bf1c844e27ebbd75", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376793, "uuid": "52812b3f-3fb5-4e5b-8f49-9bbc5e7e2248", "comment": "Malware payload", "value": "670d8bf6eb343b1dea23e35f0cfef0a7320aaea5c56aba1b63b5b04fc56caef6545851209c678050fb382740f28b798d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376793, "uuid": "8105843b-97f1-4ea7-b993-71d7446074e5", "value": "T1BB575D224111FA0AEBCA4893D3CC649D17BEE85316F923D14547FB99EDAEC1044BE3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376793, "uuid": "6a8c7b51-3ccb-47ef-9272-671acfa8f2d5", "value": "768:Rf/ZvrErEKOvsSbAvhItv1RJPkKhX8rXuANpwC5vhNnXfOHqPoNl7Lf4DRWN6i3S:jlfZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786376793, "uuid": "6818a23a-0ee5-41d1-8a54-377df8fe3812", "value": 27690102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786376793, "uuid": "8bfe4cb8-7a48-4495-b298-0e5cf8bf5810", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376793, "uuid": "55c5c74c-3a45-45cd-b1c4-e368990f16de", "value": "Wire Transfer Confirmation slip.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8c76e5-94fb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786394380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394380, "uuid": "3c2594d8-bb19-480e-b83d-6442101fa84e", "comment": "Malware payload (Mirai)", "value": "c66302477fb7660aa4a48c9b7d6ec132", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394380, "uuid": "b3779acd-0827-4278-a179-6fe2039bff16", "comment": "Malware payload (Mirai)", "value": "414e58a1daed34a76d0c8da692db46031e22724d7b60ecb623b65938ede79e63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394380, "uuid": "5227abc6-10b3-4e61-8167-8c6a4cce0422", "comment": "Malware payload (Mirai)", "value": "71fcbe007e6eec2fa6014a2970aad6c55df09481", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394380, "uuid": "edd54d48-e6f4-4beb-95f7-c93d9778c9bb", "comment": "Malware payload (Mirai)", "value": "d3f3691e5534ce4e2edd17bd54761288184d5f5c2854360269cd405dae643ed8c312f48ed65368c22a5081443b85ce9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394380, "uuid": "900bed55-b788-4f83-8097-04b6f6573ad9", "value": "T15BF31956F8819F11D5C115BAFE0E128E73131B78E3DE72129D286B747B8A8BF0E3A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394380, "uuid": "8db14760-4090-469d-9a00-050b23bf43d7", "value": "3072:SkY+oyPBiE9FQZtT+4t9FJVaBJwXmDyOWPkfxMrv+ioNZYHT:SkY+oyJiA+tBt9F/ajw06PQxMSiorY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786394380, "uuid": "b15233b6-65eb-4dbf-95ea-a7658fdd244d", "value": 158324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786394380, "uuid": "ca15b7ee-4e79-4bb3-98ae-8b8d791ab41b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394380, "uuid": "e02bbb2a-3e91-45a9-b862-449ac3dc808f", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0204cd-9505-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1786398760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398760, "uuid": "42f5e0ed-6a38-461d-9c34-977c9126dbc3", "comment": "Malware payload (Stealc)", "value": "970730ca84b2c76a69ab7d7a66c44eaa", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398760, "uuid": "4f5218f0-7400-4c5e-bc3c-9478b71d143d", "comment": "Malware payload (Stealc)", "value": "4153db289c9a3de57845890aadeec7951fcf5516fd39f25c6d8c3e42fc21f801", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398760, "uuid": "736f82ca-9bf6-468a-aa42-3d3b0bbd7a51", "comment": "Malware payload (Stealc)", "value": "b81060b760438d457b99b76fe250543d80433936", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398760, "uuid": "38923b9a-6638-45f0-8e48-260d095c275e", "comment": "Malware payload (Stealc)", "value": "f3387c3edcc8515477c2708ed32292648d78a6ff68a9d0d259401add1ac055ee5ca809beaafa6f1fa66fedf521fe3cdb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398760, "uuid": "ebb37de7-0101-4afc-9069-2d4edfa6177e", "value": "T1AB966B02EF8648F6C406673194A7622F6734B8180B39A7D3EE507A79AF733D15D36788", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398760, "uuid": "a9aa7373-055b-4bc3-b720-5f8106771e3e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398760, "uuid": "aff1cc8d-2fcc-43ab-91f9-a389968cd303", "value": "98304:ptltWjGxwSoJ4OlSAxVD60lVEIv1IDxBaW6YK:pUjGxhfc6yQ5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786398760, "uuid": "9b187aba-d220-4409-affc-806d1cd06c51", "value": 9471344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786398760, "uuid": "bea5cbd1-e752-42b8-822e-f9ddbb5da4b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398760, "uuid": "a651d0b8-7754-4874-b4a8-9e885ce65c65", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ee2695-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356839, "uuid": "5e71db0b-b9a3-4ecb-bc16-ee5c0f97c21c", "comment": "Malware payload (Mirai)", "value": "8fef12dc18195206082767f4fd15fe55", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356839, "uuid": "bb6aaec1-ad0a-4f3e-ba57-60d46a20984a", "comment": "Malware payload (Mirai)", "value": "4169898705c73de32d18ff6cbabc18ab416450d4503ba51ad66e02d256e9e647", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356839, "uuid": "317f415e-672a-4d5d-8189-36dd5279aa61", "comment": "Malware payload (Mirai)", "value": "a1ec32b649bf7d81f435672039398af6d1312e16", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356839, "uuid": "eb83f932-1043-47e2-9571-7f83990f1d48", "comment": "Malware payload (Mirai)", "value": "193791d3eeebd690df84dd4ae0b6bb900028a8f1cff4aa10ac873536285f290529db850b625e4eab2642d5af22f9561b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356839, "uuid": "696132c8-48c0-4ba8-a3ac-75ae01885288", "value": "T11D245CC7FC00DDBEF80FF3B6449B050DB570779518536A3663AB79ABAC3A0851922E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356839, "uuid": "1efe73ff-e9e6-4c63-96c8-40827a5f5148", "value": "3072:xwyt/IKrBNWIDRe9jd8SzS6yPztSEo11T6feZNugV7jbiQLrNRzGEYF12KPu:bt/LZsJ8S7yP5SEo196sNuULq/2KPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356839, "uuid": "623d1aad-7135-4c73-b734-3b1220a845b2", "value": 218168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356839, "uuid": "f3f8c1ce-ef9e-48c5-993a-d32269ad3c3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356839, "uuid": "49a85e61-5447-4fd2-acb7-dd1bb9284326", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69e843d-94ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786388411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388411, "uuid": "be8531e5-5be8-4d97-a4a3-44dde1acbb89", "comment": "Malware payload (RemcosRAT)", "value": "94ce668e58646c3189fafc6820c52424", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388411, "uuid": "f1cf33ce-881e-47db-8841-64274fd01d00", "comment": "Malware payload (RemcosRAT)", "value": "41a89f7aa20f39090bdae154194aa5108f222a654d0da8f56f98f6e8be86479e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388411, "uuid": "578fff52-8895-4843-aa69-fd3cf52514e0", "comment": "Malware payload (RemcosRAT)", "value": "85f316eca730a1acf5457f37aff5486b6a3a6ae6", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388411, "uuid": "39e85e7d-14a2-40dc-b54f-037672c7f7c8", "comment": "Malware payload (RemcosRAT)", "value": "61c76b11e7755eb87a01383d082d6bb097d9b0ae6268f6ebd8c48651486e5f79688b3d7e4085023fa6f1430b7875b0e3", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388411, "uuid": "f70671f5-a9e1-45c7-8520-5b54b105407e", "value": "T1CFF6499E15E2026769528F7CBA0377DE01B9A08C43B714999DC0B7EEFF89DC694210DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388411, "uuid": "ffbf4624-d8d7-49d5-9c12-ae51b3c3ec9b", "value": "768:XNPKNCVnaX3EeruViEFcuyNWdTSVjFc5qoJa6dgTAVjEFcnJgRlh+JWvhUJGrlcb:Ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786388411, "uuid": "15d7e3e1-550f-4e86-8840-57147ebc5afb", "value": 15929050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786388411, "uuid": "b1d651fa-7337-4a75-b8b9-5d6939c04668", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388411, "uuid": "71df77da-047a-49e1-ad92-4e54f6ac12c9", "value": "rCOTACAOURGENTE-CONTAINER-LISTADEUNIDADES.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409d1e71-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1786370604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370604, "uuid": "2619ef06-01ce-4d0a-bad0-b4740141b3e9", "comment": "Malware payload (AveMariaRAT)", "value": "f7292702ddc20a9f518c29f4a76cc4f4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370604, "uuid": "4b2fe0ff-aa1d-47fc-be88-3c947ae5076e", "comment": "Malware payload (AveMariaRAT)", "value": "41c42b9077367da12e73bc55fc099967e01b65004f278f2263afd4f036ec51a7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370604, "uuid": "79220233-f201-4ad4-ae41-f9a3b3ec48db", "comment": "Malware payload (AveMariaRAT)", "value": "236060f084b00479df21c58859d7ef2998b0cb85", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370604, "uuid": "0f466540-c4be-477a-8396-a76e19df9a78", "comment": "Malware payload (AveMariaRAT)", "value": "e6750c290bbfbb9b83873c825ef05b0e5da582f8c8b21d6532f2558ad6f7dedbb82b33d7e68f50271014524845cc5710", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370604, "uuid": "96d34f28-a926-4b44-9d23-47e2b6670d2d", "value": "T13794C0CAA6D04D35D94A9D34C0301E6402339F593E5AF346EE78BC7337B36E628A1997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370604, "uuid": "dca65f13-b369-4ec1-9003-18d675c52975", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370604, "uuid": "ed046028-43df-4377-bbcc-88125d69ff8b", "value": "6144:XQAVoCwPBmQgT1wJkP8/QtrWTIZqKR9W8BZxFzAJqw4A/mSHCX3Yh4Iu:xoCK1dkP8SeIDtZvzh/OmSHCcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370604, "uuid": "f921a336-6cf5-4581-9eeb-e7258325db1f", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370604, "uuid": "57835e5f-663a-4136-ba02-fc3a7f5d002e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370604, "uuid": "5b083174-e0c4-45ac-8b97-b333f3d471f7", "value": "41c42b9077367da12e73bc55fc099967e01b65004f278f2263afd4f036ec51a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a822823-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786373681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373681, "uuid": "cb613a10-7cae-44b7-914f-0f90f6ab46bb", "comment": "Malware payload (VIPKeylogger)", "value": "d3f254445545f72329eb8a31376cbf85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373681, "uuid": "8ebd8e67-8f7e-41c9-aeaa-7df5e2e5c94d", "comment": "Malware payload (VIPKeylogger)", "value": "42408ee8e5ac22f90451fd3260c86e52f0e3e03c6081afc7d642d627abe2cf84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373681, "uuid": "029bb059-931d-4f25-972d-d7a6881441ad", "comment": "Malware payload (VIPKeylogger)", "value": "27ad0d5db4ae7b8d8ac2fe7937a6d5f8a1b9cee6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373681, "uuid": "5a2f2297-100e-472a-8bf0-3aafce978ad6", "comment": "Malware payload (VIPKeylogger)", "value": "4d921d88c0471bb07e5ce18798006996fd92d35b8cfba3932f54e44e906e0a8d6fd96969abb6e2c8dec0d28a19fef0d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373681, "uuid": "74f8f728-4a5b-4c08-b5df-57695deb73a9", "value": "T16FA30122A37852A1C4FD87721B732354CA74BEC15823EE7F3BF5708E7A1A2985141F92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373681, "uuid": "4415113c-ab72-4229-b39e-d5de2391b9db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373681, "uuid": "dab8e5f7-8918-405c-ae9a-5c5d9545e3bf", "value": "1536:/N6ERbGQUgUoapFKZ10X+y/zWMwLQ/A1o8h5z+UKhXwaQldrd0bJrPq7S7G:/N6ER6eUoabKzWh/aMwAQz+rrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373681, "uuid": "d537ab91-8d54-4e2f-8152-9c91d874e3c9", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373681, "uuid": "b7280417-a0a4-4186-98cf-dd788b16b472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373681, "uuid": "12544fee-14e5-46f7-83b8-8b0a63f9d687", "value": "42408ee8e5ac22f90451fd3260c86e52f0e3e03c6081afc7d642d627abe2cf84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e74c929-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372828, "uuid": "04655f02-cb76-400a-9c28-568e55051e22", "comment": "Malware payload", "value": "ca4edd7d2ebb11d8e880628981f024ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372828, "uuid": "a0a0e39b-6296-472f-9e62-a60ff03ab39a", "comment": "Malware payload", "value": "42597a1c5eec0da6122881ce08f2ffae4d3a38400f3c158ae789c6202e201d8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372828, "uuid": "0e52395b-7899-45f9-b46f-f770f48fd732", "comment": "Malware payload", "value": "a5b763adb359e7d44ffacc05f6fef8b8ca01525f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372828, "uuid": "8c690fe4-9530-4e60-bcac-c45f5d44a6ad", "comment": "Malware payload", "value": "302d64d102a7b72f17adbef219174bdae6cfde8d37204f89edb81ed28bd98c54f47eb6663e157676d0c748967042ad44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372828, "uuid": "a0d36b5c-3c9f-4708-88a8-463a82c76e1b", "value": "T10CF7338083494615D1CBAFF9226F1FE3AE275DE0A269E0EF47A38471F4D5866C58C18F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372828, "uuid": "63064ea9-2e87-4de2-9ccc-bf3172ece5d1", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372828, "uuid": "27f6104f-1e50-4e73-ae1a-7cafd8c6a3a6", "value": "1572864:BLdkSDxh4UluFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB767:B21guaABZVPArg/bXeB767", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372828, "uuid": "288aed3a-7ad3-445d-b2d6-b5f0f10e8bae", "value": 72821556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372828, "uuid": "b7ef531f-0397-4716-9bc1-3f7ff434cdcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372828, "uuid": "07da628c-a41d-4961-861d-11668fb8c367", "value": "42597a1c5eec0da6122881ce08f2ffae4d3a38400f3c158ae789c6202e201d8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75745248-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356949, "uuid": "c8faaa66-4746-4c4f-903a-2f2225508c06", "comment": "Malware payload (Mirai)", "value": "c4caa4cdf250efdb8ecfa67330df68f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356949, "uuid": "40341c5c-78b8-4815-be7c-fa519a88beae", "comment": "Malware payload (Mirai)", "value": "42632385fc419e7492bc6ea22406b93844261fb7119be9681187fd2c46612192", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356949, "uuid": "4db0ab04-0ab1-4902-a3f7-a80e92caffed", "comment": "Malware payload (Mirai)", "value": "8ca084ae179ffca8215a07cd341c13755d5fc4c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356949, "uuid": "45884a90-d459-449b-bf28-cdfd405e473f", "comment": "Malware payload (Mirai)", "value": "f087fe5b21d6f0ab875106a49144b8d2a26bd12e98817c0f4b5562c5eb28ead5e46a355bb3f4728b267899b8695aeb06", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356949, "uuid": "46d86a6d-b079-449c-8cc5-8e3227aa82a6", "value": "T1CF146C16B98080FFC496D1781BFEF43AE931B0AE5278725B27D49F262E4DE615B2C740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356949, "uuid": "6ef7ca57-bfa8-4566-a90a-92fe0331380e", "value": "3072:G+wyfortJ8WzCKbh8O5BrJfUAGYAQCznl9Y6vyA1vWzJUU04Q7obj:DwCortJvzCMtmfXv+OTlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356949, "uuid": "850a18e9-8346-4445-a8b9-49ed9ac59c2d", "value": 207528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356949, "uuid": "81a9fba1-4eea-46bf-ae48-b569d5938dde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356949, "uuid": "a11a6347-0955-4587-9687-2afbc2335e81", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3229314-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786370823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370823, "uuid": "9d53d6f8-e0b9-4211-ba42-5cebc70b12bf", "comment": "Malware payload (AsyncRAT)", "value": "8284465df87cda31b4bca24429fc15c0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370823, "uuid": "4391c404-8d52-4167-9e5b-91227d8c1b65", "comment": "Malware payload (AsyncRAT)", "value": "428e478e4fd72979677f7fc4f568a2fd05a811cb3ff555a4bd068226e86b012f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370823, "uuid": "ae031f54-f08d-41b0-8e2b-a2d7c728dc22", "comment": "Malware payload (AsyncRAT)", "value": "b0fca726c690270381f9f48acc0ffe36cc762a9e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370823, "uuid": "6156a659-2a30-4ff4-bf47-993303848286", "comment": "Malware payload (AsyncRAT)", "value": "17794ce7da395220f190e75db33d6bb920c45c1ce72ba7fc51b253bffd6441a4aef3a4b80881e57d3b53e2f6119cd45d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370823, "uuid": "1b2577c7-ce2f-4fd6-8977-88c7bf7f0535", "value": "T1D8050288335BCC02C5A25FF01EB0D7B4157D4D95A811E313DEFABDABB4BE29A6C85181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370823, "uuid": "d143d42a-0e9d-4180-a28e-9a7e7bd64c56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370823, "uuid": "25abcdfe-9afe-41f8-a0dc-de137110bf98", "value": "12288:ko0/fJ6L9FOdMp+0ZO+l8fHJZnPwX9iB1gcHwxo0ROQ5n5hstWCJ3t479KFhVgUV:kFR6pF3l8fpZn4X8/gcQewdCn6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370823, "uuid": "a2be9a81-69fa-4fcb-bcbb-dc27f4675f8b", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370823, "uuid": "15686ac3-6d7a-44c0-890e-19f1b47f63f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370823, "uuid": "721cd383-af6e-41ca-bddb-4a31cc6bdada", "value": "428e478e4fd72979677f7fc4f568a2fd05a811cb3ff555a4bd068226e86b012f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c8a628-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786370888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370888, "uuid": "9aee84b2-cb00-4960-aa31-de944903eb16", "comment": "Malware payload (AgentTesla)", "value": "7826b02a5d73b2bd4c761a7da83eab3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370888, "uuid": "6dae2902-7708-40cd-9ef4-ecd4b04671d7", "comment": "Malware payload (AgentTesla)", "value": "438313337a4f7fa20ce65036e4df4efc7c74065c419ceb6c7041bb4590842f5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370888, "uuid": "3d07fb51-572d-4a0b-bd1c-f1e6fdd4eef7", "comment": "Malware payload (AgentTesla)", "value": "810a9de3273e62285b124d5d62f26b75062afa29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370888, "uuid": "b9d179cb-3411-489d-b7ce-026125ccbbf9", "comment": "Malware payload (AgentTesla)", "value": "e4d05b360ddb7d6dc1fbbb6d55f49746799c9b9da40ea7536fe5a9c0f30597fd04c63d5ab4102dadd0ff14e0540f05c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370888, "uuid": "4c701221-6299-46e5-85bd-636364edc232", "value": "T154351258330ADD02C9A16FF01E70E3F415B94E88A411F3538DEABE9BB86E69A7C551D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370888, "uuid": "55b344e8-155d-4248-8954-ab2331e5c160", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370888, "uuid": "28845ff1-920d-46af-80ae-f3b1a956184c", "value": "24576:8UR6pFX5pgKvk1Mp4cQJPmgXWKRBvpwB495P5VCbZAa4yYmgNJ:8cih5Sh2eTJvpcY5PHCbZnYmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370888, "uuid": "1fd78f1d-c919-446f-9f03-6b28943dfca4", "value": 1059328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370888, "uuid": "fbd550e2-700a-405e-a119-aab33c3b7878", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370888, "uuid": "27e16ae1-9920-4524-98c8-de89237c70b0", "value": "438313337a4f7fa20ce65036e4df4efc7c74065c419ceb6c7041bb4590842f5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b0e148-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371896, "uuid": "85bc1c7f-4851-49d4-a05e-9531ac3f9b54", "comment": "Malware payload (AgentTesla)", "value": "cb504dba59bd2d2d3fa003fb28e1de7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371896, "uuid": "824a85ee-62f8-43d4-9884-7437d3a8414f", "comment": "Malware payload (AgentTesla)", "value": "43b56732c17a9e385314f01b5c2dcf488d0d401c0dab276efa8bcce6cd19569b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371896, "uuid": "1950cb74-dfff-4daa-89c1-9655a110503a", "comment": "Malware payload (AgentTesla)", "value": "ed4cb261669def78c69c3c5cc3a4dfbcad1f28fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371896, "uuid": "d3b177cb-9696-4af7-ac59-f4a3bc23ca22", "comment": "Malware payload (AgentTesla)", "value": "25db7ae296454e4f817add542d2e967c40d99213d7058dffa5aa0c3604e85304f0c0a347b52af8551af64dd1d4733cf7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371896, "uuid": "6eeea328-4e90-4a1c-80e8-755d23452cbd", "value": "T1E32513586B07D503C50167354AE0F2B416AD2FCDED02C217ABDC6EAFBB66F5A8C841D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371896, "uuid": "3b5033f8-b551-4397-ab3b-0196aeaf911c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371896, "uuid": "9a82a4d8-0763-476f-8fc4-82345bb867a6", "value": "24576:Km+H8Uc8vCso4OIFSORh4gNGt2dPVZpe:KF5/Cs1RhS29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371896, "uuid": "8338590f-8572-4c90-88f3-51c387e11631", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371896, "uuid": "a9dd0376-53d6-4590-82e3-6d1494fe2392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371896, "uuid": "ebf0930c-fe30-4aab-9daf-dd0104e5d9df", "value": "43b56732c17a9e385314f01b5c2dcf488d0d401c0dab276efa8bcce6cd19569b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f85a06-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368496, "uuid": "922626c9-5603-450b-a36e-612055210e8a", "comment": "Malware payload (Formbook)", "value": "617775fa6174879d383c99c6174532c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368496, "uuid": "78ca9490-1255-456d-9f2d-1923504a02d4", "comment": "Malware payload (Formbook)", "value": "43dbea10a7c69096dbc8dd3bf31f982e4927f58b02b4be3c3d26432e5ff7c523", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368496, "uuid": "e9902b18-78d1-4bb8-b42d-61b6981117d0", "comment": "Malware payload (Formbook)", "value": "c5ad272cea6147b686fd90f5ba8b486c40081137", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368496, "uuid": "8bd66f65-53e1-429d-b638-dbde64550f3e", "comment": "Malware payload (Formbook)", "value": "333015679839bb674b1398bfa8c31db57fc95d64f2cfee57c2f9edc0f4538c839c3284e183ecf885afe10c95ce35fa2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368496, "uuid": "335dc549-c66e-4b3e-ad0c-a1e8a8e3e2df", "value": "T1243501C03769B706DEB916349A38EEB547F92D65B420F5AA1ED83BCBB46C6015D0CF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368496, "uuid": "f4415878-8df3-4646-92bd-6795b762cf6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368496, "uuid": "fa29cc95-f4f1-42b9-9b38-0f9e95008ebb", "value": "24576:lRflJgZ83IgNMfrswFEOd85bhqUZmj34a:3flJ0uNMfrEOCth63P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368496, "uuid": "b33726a4-a911-4b0b-aa09-d3dc739b35d0", "value": 1079296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368496, "uuid": "34de4f1e-40b2-486d-8fa6-e53bbc6a2e93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368496, "uuid": "28d994de-7cba-4518-a070-ba4e2e978fdb", "value": "43dbea10a7c69096dbc8dd3bf31f982e4927f58b02b4be3c3d26432e5ff7c523", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771eef2b-9470-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786334618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334618, "uuid": "3ca8e5df-c446-4fc5-b8ad-8636fd440bb9", "comment": "Malware payload", "value": "c34723deb13556101c52cc85acecd684", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334618, "uuid": "364d33ff-3002-4c59-b7a6-8f23afb6250b", "comment": "Malware payload", "value": "449c83819dfb00b12f8c0af99439df067baf94ba53642c153351b8b95f8569e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334618, "uuid": "b2555fad-9d0b-4f9d-a700-31e5eba0436a", "comment": "Malware payload", "value": "af2d3ea52d31b51d3570cea735c2b5e2e0c4605c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334618, "uuid": "57da08d9-def4-44d7-a90b-f9d8e5167add", "comment": "Malware payload", "value": "2296d971d774d9f2eb5db40e695cd40cac18979d6fbc404f49b8c7ad6f9bf7130421b5fcfba1d4913aa60346640e4673", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334618, "uuid": "3b290856-afc0-44fc-a3d1-3bcbb52d5fab", "value": "T134138C51B21EFECBE035993EC24385597F34AEF1B6439622F1827952517F0A31E8ED0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334618, "uuid": "6bca4982-4e9c-45a0-b039-c39f984456a3", "value": "768:OZYcSHROcK7w6TZfjI8BQDze3G3s3nMQAWeUU2ebbOz7+b43TO:BcI6T8ggzva7+bK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786334618, "uuid": "77502682-3066-464c-8e01-6e4eb73993da", "value": 41604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786334618, "uuid": "805046bb-2eab-4a6c-a29b-3e9124ea96bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334618, "uuid": "fe3f2f79-1aee-4546-8ca5-1d64cf76f1b0", "value": "449c83819dfb00b12f8c0af99439df067baf94ba53642c153351b8b95f8569e9.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afac2854-94b9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786366066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366066, "uuid": "fd98ef20-a147-4890-aeb5-80f32d095917", "comment": "Malware payload (RemcosRAT)", "value": "60b8360762c64e5cdb0b242bddea5ef0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366066, "uuid": "f6ee5e32-3310-482e-b283-7707b5042858", "comment": "Malware payload (RemcosRAT)", "value": "44dc51cfef9b16a81483021acf6f5876a9795477ee6ad5c56cc0dbbc9ce5e373", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366066, "uuid": "b1ca701e-54f0-47d3-972c-408b8921e417", "comment": "Malware payload (RemcosRAT)", "value": "55270c40fb96ff3351513bc72fb8b8b37827fd0b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786366066, "uuid": "068eb5ac-49ec-4515-b045-d125c47658c4", "comment": "Malware payload (RemcosRAT)", "value": "b5d9aaf0f87adecd91be55789965b6091771de04c3e006edecd10a790298717e59aaef5d30fedae3c523dcaf4acf26a3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366066, "uuid": "e2d4fe4f-542b-4491-8bad-16a02fa563e7", "value": "T125475E9C5375CEDBE6A6F0FB5C03E1D206459AC70866D3086CA7E8E0D94C1B6AC619FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366066, "uuid": "2c2e63ab-37f6-440e-ac9f-0fa4cd6f25c2", "value": "1536:uKc5l2U9HsRlySalGl/WF8dARYs1imsbC6YsW3+1zB5FEzXhTibChckLj0Jm/Nj8:PqNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786366066, "uuid": "8fd5053d-cbfb-481b-a4bf-2edb230ac80f", "value": 26017174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786366066, "uuid": "a53c9dcc-c28f-43a6-8fae-97cc2449e7df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786366066, "uuid": "68ef1c25-e179-4666-b4db-d60df7ad64a9", "value": "New Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ad2119-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372891, "uuid": "96209f31-83f5-4625-adb8-c65547a956a6", "comment": "Malware payload (Formbook)", "value": "10ca66558bc4b2e256306b05d12d3d27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372891, "uuid": "a3a8a955-b1f2-4f22-af56-6a63e7beedbf", "comment": "Malware payload (Formbook)", "value": "44e551147a3b07befc6a5d110a0edbcb61d840b8fea21c9afb3998f1ccfef469", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372891, "uuid": "191f32a2-9637-42f6-b7c3-a5089d6420bf", "comment": "Malware payload (Formbook)", "value": "21ac3002ad67f43cd29b3aed0d3015bfcd643aa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372891, "uuid": "715aa9e9-89cd-4ba9-a27e-0ab6f8226ac6", "comment": "Malware payload (Formbook)", "value": "cff8e6db09147105c6d2c6d97c801cdc26626c61b18d28c4b408f72c073cb9cea36fdadb3591812bf1d60cfa737a06d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372891, "uuid": "539a8423-d872-49d0-9b72-e9e977e37b3a", "value": "T14C3501142216DD81D4D68BFAB871D33833B94DCE75D2D3928FE62FEBB91A3D01458292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372891, "uuid": "0d4caa78-6504-4345-8810-cfdeb721bdaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372891, "uuid": "3660d877-66c9-4ad7-8724-f83e61743ef8", "value": "24576:0Np/WIoSQaMvFShGtW/yX5jxQbrx30lCXMNJ723WrpBp50:Ua2MdSkk+5utklCXM723Wrrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372891, "uuid": "3e466a2b-a349-42c2-92f9-c043e525fd88", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372891, "uuid": "4dbad496-24fc-43d1-a3a9-6e94054f222a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372891, "uuid": "b5ca86f6-5c46-49d7-8824-e90eae1a606a", "value": "44e551147a3b07befc6a5d110a0edbcb61d840b8fea21c9afb3998f1ccfef469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf0edcc-948f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348074, "uuid": "8a87876d-9367-4e2e-b713-99b32f9c85a2", "comment": "Malware payload", "value": "ef0358b6158b65c0527385367cd60877", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348074, "uuid": "74deec19-108a-4ef3-a1db-516db7e63798", "comment": "Malware payload", "value": "454272adadd78a6cc32d964244c35c4c2ba39cc6d29798e88a92e529e716c0c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348074, "uuid": "95bade9a-f05f-40b0-95ae-f29dd721b28e", "comment": "Malware payload", "value": "855e97c714fdb4dd2787092e12f31c18b4bc2d46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348074, "uuid": "5511e76b-c9ca-4463-809b-42abc67a9f2e", "comment": "Malware payload", "value": "8c8c0400ad1e0218aa075f610c04b9139a2d4498459de5908e5f68dc335bcf7530489e47b49a9eb2bfe98465c4c7af13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348074, "uuid": "f99da454-f35c-4fa8-85b4-ff7f79c03438", "value": "T13C23D627B6A3B47CC247C1785A9AD9F1B831BCE402213E3F97C9FA312D34D116A59A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348074, "uuid": "db00df52-8549-4ca9-b8f9-a6eec9d29c6e", "value": "768:n67zoHkjU34mQtGqKFczZRXVcolZZ4dvQuBvlljVJ:6foHkjWiHucFcuZZ4dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348074, "uuid": "056ee829-0226-4505-891e-d79b4e6999e4", "value": 46160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348074, "uuid": "db2c4549-3dcb-4a60-9ec7-a2f078c6839a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348074, "uuid": "59d19d40-bada-4ead-959e-6ca092fbb9d3", "value": "main.x86-64-v3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75716a23-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372410, "uuid": "43dacc4f-92b6-4f23-9c75-69c44fd6b9e5", "comment": "Malware payload (Formbook)", "value": "da40274f364b503f82e43425169f4999", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372410, "uuid": "698487d5-194b-4a49-899a-e4d1aa293b7f", "comment": "Malware payload (Formbook)", "value": "457c5d6c20d50e70ea52ce11b6089caec01d01385a170c30e1da9c8f73de2174", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372410, "uuid": "7a87023c-9e0c-487c-aa56-bd4cec31b0cc", "comment": "Malware payload (Formbook)", "value": "edf7a23adfbe866c62101affb89cac5c2e3fa396", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372410, "uuid": "7d463f5d-852e-4535-87f9-8cf6640327d4", "comment": "Malware payload (Formbook)", "value": "69cb0f782012cd34fba87107700adfbc0f2f66a6559a9f9a7fbc4c344ef1586c553c7df4e5867c24bfc14bb94a647466", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372410, "uuid": "c54d742a-89c8-4b0f-8f7d-2b6b19315ee6", "value": "T14D351244A6AFEE12C1B58771C8E2D0F403B21E0DD822D65B4EE9BDDB3535B468AD4353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372410, "uuid": "4f131931-0923-4652-8c1b-86609feefd55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372410, "uuid": "0fda701b-c204-419e-980c-b0ec8d4db558", "value": "24576:dKwj/Og33+yVMjubQV3LN1fG8QDM4RopG1KzUuuK5U5:8CP5AVLNJGnoxUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372410, "uuid": "35d46704-63b9-4523-a804-9f6c17aa9791", "value": 1076224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372410, "uuid": "99401312-46f3-48d0-b542-ffa885f0f2c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372410, "uuid": "d8b69d51-4d6a-477c-86c0-66253f31ec91", "value": "457c5d6c20d50e70ea52ce11b6089caec01d01385a170c30e1da9c8f73de2174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f36a1c7-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786373313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373313, "uuid": "a091979f-6138-45b5-951c-35c733d35791", "comment": "Malware payload (GuLoader)", "value": "777cd2472cc4cf6794f6d99af2e4c348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373313, "uuid": "8e61df13-b2f7-4209-b647-d8662dad69b3", "comment": "Malware payload (GuLoader)", "value": "45a471113d0bd429c682d188f97a1cdd75f4f26355fd9683fbd01228a96be54b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373313, "uuid": "10512b07-0dc7-4533-bf9c-1837545ab5e4", "comment": "Malware payload (GuLoader)", "value": "1528da24d801432b365fea5c41d9e6be2d440891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373313, "uuid": "e7557d8c-fef0-45ec-9244-0814781a9c98", "comment": "Malware payload (GuLoader)", "value": "539be3c00a37ca1e11b7a78ef9edd1fed0fed8002ab387d3379c1dc5d7930ccf5630f3f35661ef7d83db89675f53b91a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373313, "uuid": "1371738e-d874-4d13-9a20-9a77a186f41e", "value": "T17AD402C0E7409C32D6949935CECB86A6C798765AD0B784F2FE70B95E6873D7218CBE40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373313, "uuid": "0b20ab1f-17f7-4d39-adee-3c5d9442554e", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373313, "uuid": "9c084bea-a670-4292-beea-d8b9993d5621", "value": "12288:FTA5RIl2R6WoAjNwBnZTs02Y43VKuEHV+nxTo8+sMX9dkmE2fJqL:FTA5RILPAjNwFZ40P4lJLO8hmE2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373313, "uuid": "9b32f6b6-4783-4650-b808-00181cdf8682", "value": 618440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373313, "uuid": "9674332f-e8b5-49c2-8a37-8c82e29b2b29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373313, "uuid": "ce00a49a-a310-4924-a5a3-e47d9a4d650d", "value": "45a471113d0bd429c682d188f97a1cdd75f4f26355fd9683fbd01228a96be54b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f5a738-94f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1786392307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392307, "uuid": "8e5dcae1-5ea5-4359-be66-2d5e6bc2282c", "comment": "Malware payload (NanoCore)", "value": "18599aaf4e7329d96a3c424db755c479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392307, "uuid": "0434ad80-fd71-4c7a-bec6-4396ee7649fd", "comment": "Malware payload (NanoCore)", "value": "45b98ab01e767954f09e59ec7a27cc551d6ffef6ef09559903368dc36833e26a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392307, "uuid": "360e86e9-173f-49ac-8986-7a1fceec1fc6", "comment": "Malware payload (NanoCore)", "value": "971964c7ba48d3dfea6ca780590909436046ce53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392307, "uuid": "c0b14f99-8aa4-40f5-bca5-a3a0bb0a886c", "comment": "Malware payload (NanoCore)", "value": "71b723363cb3623a279fe1933164a581cc4c1d323f4cf05846e6b463bc27026e1f1658c785918b5ed45b3a911217bf70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392307, "uuid": "05a3777a-d3dc-4a14-9d63-3c5cf6c2a225", "value": "T11314CF5677A84A2FE2DE867D612212169379C2E39CC3F3DE28D455B78F267E00A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392307, "uuid": "fecb6082-984e-465c-a1a3-120c72c26719", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392307, "uuid": "f4ec6234-0e3f-4df4-a06a-26989a9d43ba", "value": "6144:MLV6Bta6dtJmakIM5o6V2qhLyNPYTbEjE:MLV6BtpmkfM2uL4YTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786392307, "uuid": "eb91bcdf-e098-4ef7-9ea7-2cf99be64b25", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786392307, "uuid": "c1d5ffb1-b7c7-4ad2-8abb-a4f04830842e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392307, "uuid": "6e2d37e8-42fb-431b-b91a-dff6f1e68a9b", "value": "18599aaf4e7329d96a3c424db755c479.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1765233a-94a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786357220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357220, "uuid": "63ab95cb-9426-431a-8cee-a0a12085e3e4", "comment": "Malware payload (ConnectWise)", "value": "2be02d3def1b116c668cc84e628e2065", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357220, "uuid": "a9e949c5-0e66-4358-ba85-963577e0d70f", "comment": "Malware payload (ConnectWise)", "value": "45c985d787b9f8730c4b05555f8ecf28f9c58f0948c5180108ca185441ab145a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357220, "uuid": "92c58af8-752e-47ff-a6a9-8134d7625ab6", "comment": "Malware payload (ConnectWise)", "value": "6c8ee646afb6b19ade6af5333c52c5263103f949", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786357220, "uuid": "3455aba6-17c4-4288-ac63-f69b58411a2e", "comment": "Malware payload (ConnectWise)", "value": "c2664d4aaa9bf2afb26f7a84b53aa84325e1c8364b21a5455320df213ef3447e76f001358216b6ada877059e44c61207", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357220, "uuid": "9dfa45ca-528b-4ea5-9fa7-9d5679c1b615", "value": "T191647C11B9C48432C273383147B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357220, "uuid": "5a27b501-5303-4e85-b6c8-305b7b7fdc1f", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357220, "uuid": "7c1b1850-d1eb-428e-820e-a4e634c208fc", "value": "6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9d:J1iw7gryNkSV1hy1Z1u2JLu9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786357220, "uuid": "9dcbca3e-4bda-489e-8459-0dc8f048eb43", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786357220, "uuid": "25f56d9f-3e8b-42cd-bef1-3183d772b4fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786357220, "uuid": "e05b8943-6d29-4e67-a8ce-04c34dd20991", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc18abc7-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368234, "uuid": "5aab879a-5de6-4f3a-99b0-8afedccdabe6", "comment": "Malware payload (Vidar)", "value": "05c98470771cfd7a1fc0b1ca62e317a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368234, "uuid": "638fd5dc-0b2e-4736-a54d-bd33084e46c1", "comment": "Malware payload (Vidar)", "value": "4636ec9fdeec97f6dd7b626022350207817c69635a0418a73092a53de67bf167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368234, "uuid": "3636cbfd-947d-4213-9d37-96d22512be3e", "comment": "Malware payload (Vidar)", "value": "5e23f0fcf22e62f03322f687b787db6e69f6e39f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368234, "uuid": "9d271036-4e76-4601-bca7-a2b683e673b1", "comment": "Malware payload (Vidar)", "value": "562c3b8ec25546896670ffa792ed062263215b0a16611a42ff23706db15a2cebee2d5362bfcae6d0a5b70f035f21a856", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368234, "uuid": "c92abd19-edc2-498d-bf03-abd33df01bf0", "value": "T13B828345E017AEE4C4D5C333A79A566315FC7C2022329B3B6FEC6B2A0D92370E6552ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368234, "uuid": "043a521b-c0bf-439d-91f1-9a238312f557", "value": "f6ed7a812e36f2c87231645354e7939d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368234, "uuid": "1389eeda-a20b-46f7-9b6c-b76ddf1e2864", "value": "384:hL9miM3OYW8pjEvsCHbxiAvibdny+lwDkUq/lJu:hALTCvtXRoJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368234, "uuid": "008b5310-8fbc-4834-8f79-8b0cf2212ea6", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368234, "uuid": "3c7a1c74-83ba-45fa-aace-f5b95fb125ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368234, "uuid": "d570ec5b-3d82-4af7-92ca-eeb2d1169ccc", "value": "4636ec9fdeec97f6dd7b626022350207817c69635a0418a73092a53de67bf167", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b562d73-9484-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786343027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343027, "uuid": "7f88ffb2-f450-43ad-90cf-ed585a0b5e92", "comment": "Malware payload", "value": "bd7f26f4fbb6a6b070db642cdb5689b4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343027, "uuid": "97d60f85-319b-4d3c-abe6-4ee335dce06f", "comment": "Malware payload", "value": "463e2b5492a1858159c7a8bfe64820eec9bbe05fd60c4d39254da778008c6469", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343027, "uuid": "8bec3cd3-cf3a-4f95-8266-fc5abb318d60", "comment": "Malware payload", "value": "02463c446f247ab4ce67528d666f47aa763da569", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343027, "uuid": "e13ce40b-2411-4d91-9543-2f8e20a68557", "comment": "Malware payload", "value": "e04a6b8e6730b31662eb7e4c6e0ad116e80770817a518269eb20f49d66ab0895097b693bddef93a8adcce01272ccc32b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343027, "uuid": "777fedb6-14d7-44e4-b7db-c69dbbadb945", "value": "T1FD11E9C5360629B2DDAD9B1D7C52C8B2D405A3CAE8C3257848B96C2B1C84F2CB84B91B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343027, "uuid": "5e396a83-da65-456b-b794-fdc77f51831e", "value": "12:KrHcHA1HA8HgjH0HNZXHb8HEt0FH9H2QBsUXpIvRffiFl3zUzE1tjh/ZBsr:084J8UTIc8dWQq7yFxdhhqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786343027, "uuid": "88941f5b-adc0-431c-b5d1-c49d957803de", "value": 856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786343027, "uuid": "ba7102db-bb5c-4b1a-b44d-d6c603ad47f2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343027, "uuid": "ef8c242c-fdf3-4e8e-97fe-bd2a7577d22a", "value": "Exodus.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314e4ef6-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372296, "uuid": "f58eac8f-e57d-428d-bed0-337a4914709f", "comment": "Malware payload", "value": "049ec27ea3b154f03f8baba26dae3308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372296, "uuid": "1ab80ad7-4c5f-4bc4-8f77-82fb290c1a22", "comment": "Malware payload", "value": "464f3d79673b3bd8bc3b9f3ddafe38275256b2edc870f5a80bcfa1574d18edcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372296, "uuid": "830666fb-d4f9-4131-8c4d-9628d331c3bc", "comment": "Malware payload", "value": "7871879b6e7e649b7df001ddcd9f61b27f730c76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372296, "uuid": "1a477eb5-ede2-4142-916a-5d895608a34a", "comment": "Malware payload", "value": "ff7e61752c44bb249afec06a06a0229e411de236ec5d67251c824c9165bb5fd756f4e6d2d395236491fa268508f7be0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372296, "uuid": "b415f3ea-dbee-4cd4-8d54-888f4b69b7a8", "value": "T12355BF21B69790F3D6553A7014BA2B3F9E3DAA460B24DBC39364EE2C6C331C19D3715A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372296, "uuid": "1168a4a6-7a3f-41c0-89b7-4f2029e245bd", "value": "4ca36c0623611345ee5fabf3cf68d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372296, "uuid": "c40911ae-575a-4d1b-9f6e-30b242f2013c", "value": "24576:EqqyOTWxNBxj3oElG4ADM8pa495kQwFn3nWBWic9uRt2Nr:EqqyOWBxVlG4cPs49fmtic9lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372296, "uuid": "bf42e04f-b1c2-417e-a4ec-582886305072", "value": 1314816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372296, "uuid": "4270be08-e41c-4687-b52f-942c0844221e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372296, "uuid": "9bb78088-a7c9-40cc-bb72-f69a1da409d7", "value": "464f3d79673b3bd8bc3b9f3ddafe38275256b2edc870f5a80bcfa1574d18edcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076f3f9d-9465-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786329706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329706, "uuid": "c809c506-1688-4e02-9871-a0d0fbb56fb5", "comment": "Malware payload (Mirai)", "value": "a60f835033d559d2a83132212372f837", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329706, "uuid": "5cadf247-f14b-4e06-90ba-be7e24e2299f", "comment": "Malware payload (Mirai)", "value": "470a44a079d8194bd10e4c19bd63cc38688b2fce21ddfdd6657e1e6caf7401a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329706, "uuid": "30715a20-4694-4b14-a5a7-fa4effecc5d5", "comment": "Malware payload (Mirai)", "value": "ba47ce7d5528f300ec4a32e369375da70e775aeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329706, "uuid": "43a812f7-4fa5-4f07-9af9-4a3044e78350", "comment": "Malware payload (Mirai)", "value": "4b7010f2722fc4368315705946a19796d566adc2505468701c0e0ddc3b8840a147d58053f39ece9cba33ae56a2147a8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329706, "uuid": "daa4a0f8-5c91-45a3-9a91-198a25b65a76", "value": "T147031B46EA519B09C6D272BEFB8E014E37176FA8E3ED32359E306FE013825E70935525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329706, "uuid": "1c30d4f1-b8d4-438a-9cce-4c9b104c5563", "value": "768:MknfZ7W0BFWJpzunYeNLDvm9pJ5M8Leio6hg+wd9SaVjHgyh:Mknf9VBFWJpSY2SjDMTio6e+wdRgyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786329706, "uuid": "736589fe-73c5-4184-84e9-c49015f954c6", "value": 41128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786329706, "uuid": "ff5a9fe6-6da7-4ecc-be07-d3fbf6717bc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329706, "uuid": "fdfb9acc-e43c-4d51-9d98-def8f50cd60c", "value": "main.armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6490b10-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368305, "uuid": "548e2420-d9b3-4a9b-b133-01d43851975f", "comment": "Malware payload (Vidar)", "value": "d0561ecc04bf9ff834e5496c8a3a5fb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368305, "uuid": "29a253d1-dc8b-4e1e-a42a-3843e54c12f3", "comment": "Malware payload (Vidar)", "value": "4710b1ec5eb0dfff19678665ff727c32968cd113f59c04de67a4e45388861cb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368305, "uuid": "d6dd6335-fc22-446f-80bc-f3346959df72", "comment": "Malware payload (Vidar)", "value": "b7daff88a4186c51766c04bfa22907e4c0f7827f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368305, "uuid": "8fd50e43-e3f4-4ebf-b4ab-ee86d63d2d99", "comment": "Malware payload (Vidar)", "value": "ae0c75bb48cf5f56226f5752ed08ec6b7a5070f061f4e327b4666d8c94fbf5e0c2fa87b92f0d58e232583e5d52fdb089", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368305, "uuid": "7742442b-4944-40b1-b677-df54c5774207", "value": "T18A925E46E15B52F4C0EBC337575AA12756FCBC052236AB3B9FDC5A610D02330EA682ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368305, "uuid": "28a48dc2-58c3-4999-9988-3d2ff1455880", "value": "e94e649e836c8320627dfabdbb134df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368305, "uuid": "31d45bfb-13f2-4de5-874b-57263044842f", "value": "384:OHAkrKM7JBeakkvqk/h9CCkWI2W/fuxl:uKKkkvdRIl+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368305, "uuid": "f631da95-6396-47ac-bffc-5e40ff23add8", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368305, "uuid": "05cc1244-879b-47ba-b1fa-bfec3b62458e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368305, "uuid": "06adb862-7a8d-41a8-8b80-8226fb786429", "value": "4710b1ec5eb0dfff19678665ff727c32968cd113f59c04de67a4e45388861cb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f065c48-94f8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786392881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392881, "uuid": "281075fd-9f90-4215-8412-764b2b93b71f", "comment": "Malware payload (Mirai)", "value": "4be4b3545e5348e18f57c4147e5fcb64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392881, "uuid": "63b31a97-ab7a-4283-ba2d-98413370620f", "comment": "Malware payload (Mirai)", "value": "472f4a7e637a974902135e6a2ca0a3ae4ef2c8e754beec0e359fa10e12c490d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392881, "uuid": "579211fe-53d4-4edd-870e-66655fb0c3c5", "comment": "Malware payload (Mirai)", "value": "b8f3249252446937e3f33cde43acc846c9ee60ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392881, "uuid": "6f9d7138-d2cb-4d84-a7a4-aecb0f4617a5", "comment": "Malware payload (Mirai)", "value": "2b91cfb899f061320d55d9d70ed8a0f007080fea993c940fe8f9ea2f25d473011216c219a05a3ce8341bee54196da1f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392881, "uuid": "8bf79bd0-b3f2-498d-b4a8-7f934df07dbb", "value": "T187F3E70ABF610FB7DC6BDD7702E90B1529CCA81725A53B757134E818B50B68B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392881, "uuid": "ac38eefc-51c3-4ab7-9d03-0953dcf3352f", "value": "3072:vLMayco2uXZrZKpGk9Ct+qnGC5T7bpeb7ZSa:jJyco2uXZrZxPwqnt7E7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786392881, "uuid": "ece63fb9-c0c1-4d8d-ad53-f6cee61d8fd4", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786392881, "uuid": "84891461-440f-4c74-a18b-61c189d8f469", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392881, "uuid": "a0bdce03-229b-4ec1-b53d-920285096673", "value": "data_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7effb07e-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383593, "uuid": "7365eef3-8be2-4f25-b3f5-30e0304cf0cb", "comment": "Malware payload (Mirai)", "value": "be0973c159166dc47bc82c2e4d793bff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383593, "uuid": "0ecac0d4-3694-45f1-a923-6e9d5f9177b5", "comment": "Malware payload (Mirai)", "value": "474979d43bcc34ba4c897a0397042a97453989f84e4f41b7dac9c1ed502d9905", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383593, "uuid": "8e4cf474-2173-4e8a-ae7f-cba6e7d40240", "comment": "Malware payload (Mirai)", "value": "d3695e4f362cdea85b59b60d1b6c623153e2d848", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383593, "uuid": "b62ebc73-7359-4563-8f22-28ae3710122f", "comment": "Malware payload (Mirai)", "value": "80867cc50263850157da6a610b1edc3e1e171072028df32db66b55fc40202ef852d773935ff36c23e8332b148e5d1df7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383593, "uuid": "46216ed8-8315-4218-9bd0-bd90bb7539fe", "value": "T1ACF36B82FA83E2F1E5971570001BA72F4B319D398224DE1BEBA42E31DCB6706565B77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383593, "uuid": "e66471f4-6cd0-4898-997e-3c7e9f07110c", "value": "3072:mmLZS7lephFrgaEZFbfbWaAf4nxvWmkbjWf22p2y/PSWTaj4vkRazlTtJ9pdaJN:bLj3OFZFTbWag4n7kb6fpvTa5MHJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383593, "uuid": "474420b0-a074-4aa8-beb8-4eaba68d22db", "value": 161204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383593, "uuid": "50bc0b3d-6d67-478c-9855-e05b486b83fa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383593, "uuid": "6ba90389-02fc-4b82-8274-6e9d3a18ef01", "value": "disconnectraw.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de185d4-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786374035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374035, "uuid": "fb53db4d-b484-49e1-85c8-596f03d046a8", "comment": "Malware payload (AgentTesla)", "value": "a6d9343937044aa2bbd88242d974ce2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374035, "uuid": "ec7f3a3b-dfdd-4d10-b415-c7083dfeae2b", "comment": "Malware payload (AgentTesla)", "value": "476e56de551b76b2d631e0b91a9714bbb1e304a5a8c81bf85e97a47b38c91e82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374035, "uuid": "adacceef-d463-4329-894b-60ddaaeaffc1", "comment": "Malware payload (AgentTesla)", "value": "40d33bf4f95194808ba18b5d818810c3026a5c32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374035, "uuid": "414f8011-f222-496f-aa40-442082707c2d", "comment": "Malware payload (AgentTesla)", "value": "d22fd502087ab3bccf304192941932f687e1e95afe988cfb732eea907bffd594a9a57d8283612ec88c4d75502e43c185", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374035, "uuid": "2bb4b105-487b-4646-b6fe-57993ce6bd6e", "value": "T1F974F141B780A667D5F14E7359A7CB725372AF754702470BE394732B3EF22839B0A288", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374035, "uuid": "6b63e4cb-a8dd-4520-9d7a-38328268f99f", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374035, "uuid": "29659829-b8de-4fb2-83f1-0c3768ea8944", "value": "6144:AicFyQyEBErg9v0jhbq9IBszA6xXu+Mh9rdRYjZIdLgliE:rgEcx0jhbq91nxe+O9rdRY+6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374035, "uuid": "bc15a06a-30d6-47c3-b3a3-1eaf65b0f13f", "value": 347985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374035, "uuid": "ed257798-fa66-40dc-ac48-9b4667269484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374035, "uuid": "a8e1ad09-7a32-46ca-b3a4-9d036edbf0f7", "value": "476e56de551b76b2d631e0b91a9714bbb1e304a5a8c81bf85e97a47b38c91e82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653ef99b-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371095, "uuid": "80e956b9-ea5a-4e56-888d-24a0b5fc1199", "comment": "Malware payload (Vidar)", "value": "5a8e5550b118e3111a1380cebca0535b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371095, "uuid": "5804a051-74c7-4dca-a9b5-a6cb50d9002e", "comment": "Malware payload (Vidar)", "value": "47adec31c117914388b712ced06aeb54e41d666b13fe61c24051e557bd5b7ae8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371095, "uuid": "4d55b882-a53c-4ad3-9225-16f88243a93f", "comment": "Malware payload (Vidar)", "value": "a0fe4f2c49b345e8109814803c78146114ff0c1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371095, "uuid": "106db9f1-63fd-431f-9b40-6bdc4c685f68", "comment": "Malware payload (Vidar)", "value": "0825c9936203f76f13b4cdfbb2b8fa54e02f4a25091363dd6cbf6d20ceebbf62441b39c769668008b312a8f9436e007b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371095, "uuid": "203306f5-f3d2-43d6-bbc0-1cd8fddc5f7e", "value": "T195929541E107AAE4C4E5C732675A126765F8BD2021369B3F5BDCBA3F4E51330AB442ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371095, "uuid": "4cd8273f-dcdc-4a77-8a9a-d6460e1a9f98", "value": "85b0aeb0d13fb5c7226c80e10830c4fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371095, "uuid": "041f5850-ec0b-42ab-8907-8aee708c4c37", "value": "384:QHkYQfgHeu8eKhoMoEkLKdPvqOgTHkvRQCwdpDXEmb80jMMO5lwYp:QHkYQIHfKh9gKpE6xwdN0mo0QMGw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371095, "uuid": "4d89df1f-3777-4491-9d72-3ae86f2725c0", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371095, "uuid": "bd6bac72-aec7-4830-8ddd-0f6d749c36ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371095, "uuid": "a5ed4b8b-8620-4699-8e48-c5f920dc76f5", "value": "47adec31c117914388b712ced06aeb54e41d666b13fe61c24051e557bd5b7ae8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b072f51-9460-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786327779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327779, "uuid": "a26ef1ff-e6b6-4e7c-b279-26eed642fcb8", "comment": "Malware payload", "value": "49d67a68860e618990b70a8bed6c160e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327779, "uuid": "2f84f7af-c445-4a84-a5f4-95056686a248", "comment": "Malware payload", "value": "47c89331a453ce7d3a340dbedd22963e97926991ad405272ebc9bfc0df410e3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327779, "uuid": "e5714476-11dd-42b7-83a7-68ae1432845a", "comment": "Malware payload", "value": "95b3334112d9d5bd29afb5167d54ecf674fb5619", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327779, "uuid": "a2db4e63-22f7-43ba-9eaf-45d6c34b3f30", "comment": "Malware payload", "value": "348c1c66a1b14d8367bcd21525fc5e4947b7dfd1df6f7329f31791d1932167b9f3483673b252ca24339e8a694e84033c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327779, "uuid": "32c0e969-0671-4865-ae65-6ded69cf9520", "value": "T1AC630A95F840DA35C7C075BAFA5E02DD33130FA8E2EA31158D21AB353BF7A594A3B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327779, "uuid": "59361ed5-489d-4682-b70b-f70319fd749d", "value": "1536:tYSAHU6DnejFhsX4XMwb4nFxj5ITgqDMtAnDndzlnUHY0zlpcwhNOkC0r:tkq/ineHzdzlnUrcADX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327779, "uuid": "9af1dca8-6ee9-4220-8f64-6d739597c863", "value": 70536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327779, "uuid": "3b9f13f9-aaea-4250-9a33-be10ec028d3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327779, "uuid": "358e8aab-fc47-478e-92b8-1208734fe104", "value": "main.armv5-eabi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e9d1286-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372909, "uuid": "7dd793c6-4403-43c6-a702-b612f48efefc", "comment": "Malware payload (Formbook)", "value": "b6818dfe0f1350aea64b804b5ff43c81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372909, "uuid": "cc5d46d2-c058-4a8a-ad7e-f976d3edaeb2", "comment": "Malware payload (Formbook)", "value": "47f274e9fd4143dc1cf9cda2e69ac95174ee075873a8be6398b14acefff2e8a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372909, "uuid": "577a3241-3b7e-447d-9f1a-2b5fabf7c36b", "comment": "Malware payload (Formbook)", "value": "1de84717be748b76e2edaa65f5cf9c4feed0cf13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372909, "uuid": "13aa84ee-3c6c-47b6-a5ef-617ed0ee0ac3", "comment": "Malware payload (Formbook)", "value": "0042bb4b3685f0bc38c0c564ef4ca7363865ebc163a9dbdbea5d71f48331180067df9760e3d8056a40c976dd88cb60e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372909, "uuid": "c7bf3f8a-41ff-48ba-86db-4dd483f17b6e", "value": "T1FE15022423568A02E0E687FAB960D33433B51DCF39E2D3D69FE62FF779193811954682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372909, "uuid": "ed0bea0b-daf5-4dd9-8ffc-10ac172c5dd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372909, "uuid": "c79a2a09-e8a4-4d8b-80f3-9db2ffb66320", "value": "24576:nGp50iUcf+xNID5W1mZp8cbWjrvF9JUfeGtg+:GpniNIDPPFnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372909, "uuid": "08b6b6cf-32a9-4fd2-ab49-ae45ea2caa84", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372909, "uuid": "827f7ac1-ce75-46db-8d78-4b20f0d24b81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372909, "uuid": "ecb07947-7c1c-45d2-863f-468501b5cb9f", "value": "47f274e9fd4143dc1cf9cda2e69ac95174ee075873a8be6398b14acefff2e8a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fded1297-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371780, "uuid": "128c1c02-f0fb-469b-9841-04dd11c4238d", "comment": "Malware payload (Formbook)", "value": "bc8fc58d0d007e4c06b3e7e1fc64aeea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371780, "uuid": "d74fb078-e67b-4ced-b92b-083fe93fef1b", "comment": "Malware payload (Formbook)", "value": "4859f893660b9e29b06db46f52299f60ad5d59beaa3977d86557b632c965a2dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371780, "uuid": "3d817161-1c33-44c2-ae76-c67bf09a9dc5", "comment": "Malware payload (Formbook)", "value": "0246037d43e3ef8267735b8484f7713089bffe34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371780, "uuid": "5a551f7b-ef46-4c2f-b06f-ef695c6225f8", "comment": "Malware payload (Formbook)", "value": "d3707d06b4558902381c81bd2bdfdff24974f3a8372a3252187fc27f67cad0848833b13fcee7e5e0c77d640b138fd7bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371780, "uuid": "8798ab09-fce5-48b9-b906-ab16c5a544ca", "value": "T170E58D46B3D80AD4E5E7CA34CA199732D7B1B8560332975B1B64C30A2E77AE34F67321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371780, "uuid": "72c66230-b9ad-4890-ae7b-873bd1f1dac9", "value": "b0253ae8279600c3d8dc02919670baab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371780, "uuid": "4d89daf8-ff81-4173-96cb-d0650ba922fd", "value": "49152:/1/YpqU4fDaFThvDug3jpgFDttr+Am0NCFWp:R0JTj0NH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371780, "uuid": "2ca610e5-9942-45a3-b626-4fa07e5970fc", "value": 3269632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371780, "uuid": "1f6c9032-29d0-4f84-b872-b193126840ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371780, "uuid": "31f1fd2e-3dc9-45b9-a7cd-ac9be4e86906", "value": "4859f893660b9e29b06db46f52299f60ad5d59beaa3977d86557b632c965a2dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8101e28d-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786372000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372000, "uuid": "117e3155-0714-4a57-bb49-e3c5992f9d8f", "comment": "Malware payload (RemcosRAT)", "value": "d7d3c565433be9f9b975300739afe114", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372000, "uuid": "bba9db92-0244-4c93-a53d-d2cfca0438fc", "comment": "Malware payload (RemcosRAT)", "value": "486737f53db4aa7de0e645979a4b318a6125f8bd8e3b25547ebd98816bafbc36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372000, "uuid": "409a7b15-a6a9-491c-b269-514781f53bc6", "comment": "Malware payload (RemcosRAT)", "value": "faf0bcca3702eca5e297d1df1da3b86b2b8d83bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372000, "uuid": "7253cf10-e948-4aa8-b8e1-fb6bc46ac857", "comment": "Malware payload (RemcosRAT)", "value": "ddd380a2954c991dfd4cee536b6a8d51a801437ae3bc39582e4af4c85e441cb3745eb7c180de49d0b7724ea94ab78068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372000, "uuid": "31ba8f00-3ccc-4d2f-beaa-f5a6cc8c81c8", "value": "T16E55231CDB4BE902C5515639ACE5F2B033BC1FDCEA42D613AFDC6D6BB924B5A88400D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372000, "uuid": "831f56cb-d960-443f-b810-28e9573048b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372000, "uuid": "2b13f02b-0fac-447d-a066-493cd325a4d9", "value": "24576:BL58tXXs4WQuWGWz7MKZ4SNhg+WjNbZPSJLkRZAkWgwFLI6pw/:BetXEDpWzI+Jg+WjNbULkRZNV36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372000, "uuid": "e69dad51-f25a-4afd-bcf6-c6281f57f458", "value": 1283072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372000, "uuid": "aa726423-d8a9-4faf-bc28-2c0719de7b66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372000, "uuid": "1cc25fe0-e5c8-4c4f-b2f1-a01d556d3a18", "value": "486737f53db4aa7de0e645979a4b318a6125f8bd8e3b25547ebd98816bafbc36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214fcbbd-9486-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786343923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343923, "uuid": "82c0cdc7-c373-43ff-a96c-62f6e2dfeb3b", "comment": "Malware payload", "value": "7afb03f33a1b22c7a12598418495156c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343923, "uuid": "c5c36c8c-21dc-47f2-9486-460ec851572d", "comment": "Malware payload", "value": "48f39608f83b35a4ea8010d50754c5d5dd0ef5d2a1e47db2eb17aa58b0654591", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343923, "uuid": "9d3a1307-0d46-44df-acfc-cccca9f675d8", "comment": "Malware payload", "value": "67038a20653eaeda5038e6ab0f72b61ccf496e2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343923, "uuid": "c3570af0-0f67-41c4-a536-99f47454b255", "comment": "Malware payload", "value": "9afbc0b126845dfebe95c76a754d305ef1b8c3db9d0a91abfda67ea4acca41a884b0e9fa9a8e71228d587181f1e6caaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343923, "uuid": "357c278b-efbc-4b29-a739-6e6fb021c9b1", "value": "T15DA36C47770B2880F82202F167DDA3E03F1561CBAB321EB7586A62F76FB31991D09752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343923, "uuid": "16d6909b-12bd-43df-83f6-6336646a81ab", "value": "1536:/wlF3aklNUWWLCdjKHnKIA5tax34jgLxUn5p5M/LWv:IlblNUp+d75xgFhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786343923, "uuid": "8713c9d3-0281-4de5-8a09-ea3f88e2c49e", "value": 99828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786343923, "uuid": "b95bb74d-f8b7-48dd-82d6-2eeec1e8ff5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343923, "uuid": "8309f773-e9d5-4d8c-a791-2f6b54ef0655", "value": "main.archs38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06879193-94ae-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786361057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786361057, "uuid": "cd395922-673f-4d28-a8a6-0531da9ef1bd", "comment": "Malware payload (ValleyRAT)", "value": "bf2db66718891a55da5d82817cab742d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786361057, "uuid": "f0960074-7719-4b27-b4ea-0671d2b55c2a", "comment": "Malware payload (ValleyRAT)", "value": "4972c57c77b67c080fca0e1f97e650894f7b60fb50d049ae9f43d83759fad701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786361057, "uuid": "b59007c3-edfb-4d0c-9daf-1d13cc59cdc1", "comment": "Malware payload (ValleyRAT)", "value": "f0dc5b597d28aee11eeb68ffe2a1d97bb1f72d37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786361057, "uuid": "bd488020-1f11-4d45-976a-7d74c712bd0d", "comment": "Malware payload (ValleyRAT)", "value": "c11087612c3488541bf6de2691b723198fb751ba3113afe913d09714fe63358ab197abe6ec844dd72bbc37e3954734d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786361057, "uuid": "57167856-a798-4ba1-ae8f-00acee5080f3", "value": "T102F57D87B6F61354D9B7C138C6A7616AEA717C428F60A9CF125CB3191A736F01E3B318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786361057, "uuid": "6b05ffcf-abc1-45fc-9aca-a46f1364a481", "value": "1d6756920139c62afca29cb579fd4954", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786361057, "uuid": "f8395dd8-f89d-40ea-8ebd-1e177afc6d20", "value": "49152:JDAn2xCeeraP8k9CVrggiL8PhzhJsv6tWKFdu9CcPTvG72MqOqRsjfJXcRWYNoi3:qDC9dQHJsv6tWKFdu9Cci4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786361057, "uuid": "670091bb-36f3-4ff8-8848-b7dfbb447eb1", "value": 3593216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786361057, "uuid": "195850ce-b1dd-468a-9843-456bd5a3dc88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786361057, "uuid": "f678fef0-267f-4cb2-99e2-71a847ef63e8", "value": "2026.08.10\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u68481_SUE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fb8bc2-948b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786346368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346368, "uuid": "be24efe3-35a5-4b19-a354-cb0aa4e80078", "comment": "Malware payload (Mirai)", "value": "1b33ce9f707643849044aa530815cabd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346368, "uuid": "baefa2d3-1956-4101-bb59-3ca7cb15bb71", "comment": "Malware payload (Mirai)", "value": "49953426505129ac957c0bb48791d63516d008d85d22afa711e62403cec7ed06", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346368, "uuid": "b87257b9-e5dd-4c9f-8a5b-1a696df77d76", "comment": "Malware payload (Mirai)", "value": "73de854eb6bfba70167b69d85eeb91e8e3f2a0de", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346368, "uuid": "6e2f3cfb-3b12-4555-9aae-5735a7e49b35", "comment": "Malware payload (Mirai)", "value": "7b24e359a245a30288a86bd481e13a45ff9d7a2cad630c49582a403507a9ad7099edb53fb3ef95ed11bd992e58d80f33", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346368, "uuid": "4b2a71c2-2cf9-46fb-9b7e-d33f579116b6", "value": "T1B801C2D5D1505E044069949E32E756E0B831C3C7495B4FA8BFDC953DEB98E04F0B6F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346368, "uuid": "d85df4c2-a18f-4599-aff7-fddeb6b7c90b", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaakCmFwFC7huCFR1B6FCYKgV+3ClauD:kXCKysE2hi0ziQvZohaNqFWcNFL807", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346368, "uuid": "6ccb8c72-7f95-456e-a683-04c93df6ecde", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346368, "uuid": "134e2396-90c0-4832-9291-5587e98b90bf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346368, "uuid": "5d2a65e1-7654-4076-bfff-2cc766320818", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4459cb17-94d2-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786376623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376623, "uuid": "c508c43c-3e7a-4ab3-ae69-1fdc1d1316e0", "comment": "Malware payload (CoinMiner)", "value": "6e6d89b2950e9c427f8455166c15519b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376623, "uuid": "9e844de8-eb22-4eb2-876b-94113abfb4eb", "comment": "Malware payload (CoinMiner)", "value": "49e714b951da38e4e74534fdf2f2905ff59b81804936fe6b639343ff5f30cf41", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376623, "uuid": "71f1b924-3fe6-4418-915e-694b629c4b6e", "comment": "Malware payload (CoinMiner)", "value": "a90bcd318ff68173f4f621273933b17891fa7c47", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786376623, "uuid": "f703a6ae-f6ea-4caa-8665-eaad02c57641", "comment": "Malware payload (CoinMiner)", "value": "e17fd3e2587b1ed7e9e065e163e9e151a2cc66123b7ab94c440e58756d370ebb0a38ddea657a0b0eaca4950cad710020", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376623, "uuid": "bc87d6f1-edd8-4494-a544-1be423dac893", "value": "T1673633C59DE69571C016C3F49522207CF23ABB5A9765BC07BBCD9B10DE26B186A3E3C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376623, "uuid": "e4b246e3-e149-4bb7-9bed-119efef5b09e", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376623, "uuid": "da8039dd-ca02-462b-9b06-c6d1b135c73b", "value": "98304:ye8lXBjxrm3Y+CvVuOtibBbohtJol+88kIg4aATOLy8R+39iPr5KS:ye8tBjxr2fOGehtNNkOaATB73KFKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786376623, "uuid": "cd4ad56b-3be7-40ba-a854-c507ef49c854", "value": 5247488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786376623, "uuid": "a4463045-3105-4fcd-b5fe-e9a0fe19229c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786376623, "uuid": "e0f79422-534d-42d2-ba62-66f081f25ead", "value": "49e714b951da38e4e74534fdf2f2905ff59b81804936fe6b639343ff5f30cf41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7c1537-948f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348077, "uuid": "72c506fa-6f54-43f7-aa9d-1f08bfd4d90f", "comment": "Malware payload", "value": "52f953a5a18059b9cd9204fcec0d2a34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348077, "uuid": "210a6f33-2f82-4342-9db4-c008d5296578", "comment": "Malware payload", "value": "4a05392d745348f925ca7371cb291d22646d6e918bf7c552d17c0a34cb4e2041", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348077, "uuid": "2564621e-0315-4ba2-87dc-93535266da7c", "comment": "Malware payload", "value": "94304b38fa73263f977da71625cafece61f2cbe9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348077, "uuid": "4cb35ea6-4baf-4da1-95be-11256c3b40fe", "comment": "Malware payload", "value": "39a846067c4008bb8a7a80d8cc8e60bb4fbeebf17ef5ae22189cfd601ee9d4a3cf91972263b2008ecc90282d0c5c9854", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348077, "uuid": "bf5d3db8-2b4e-4828-b1bb-e88e683e3d2a", "value": "T1ABC23A01F3A2EDBDC8D64335481B44B079B8A8B5DB714BAF678087B72863B5C8D2E715", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348077, "uuid": "d2a7bd92-d577-4bbb-96e9-01930d19c17f", "value": "384:YuvdvOm0FmjGxQWDj+3/KERT9JyGeoCU6:X1gmjGxQgja/KeOGeov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348077, "uuid": "a99346e8-88db-42e2-ad00-358fa2abefce", "value": 26984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348077, "uuid": "ebce5dcf-b4df-4648-9c1f-4d835be03750", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348077, "uuid": "9164ac64-145c-4fe8-87d7-d1f02ae336fa", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56dbab48-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786373218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373218, "uuid": "22d6f12b-d855-40c2-931e-b35d11b0a677", "comment": "Malware payload (MassLogger)", "value": "18899bbab5c273e374312140c6280229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373218, "uuid": "3b894b53-d89c-40e8-93cd-fef6c503ae2d", "comment": "Malware payload (MassLogger)", "value": "4a1b87430fe4ad7a1e9a35d99f7c612e7f2d8dce339edd172753aee1632653cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373218, "uuid": "3c302107-9ec7-4ba3-9e89-e6d152df561a", "comment": "Malware payload (MassLogger)", "value": "acc597aad24c1246bd479bbd84b275e233daf426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373218, "uuid": "dbce5350-16ad-47ae-8afa-b780424c7479", "comment": "Malware payload (MassLogger)", "value": "475a111d0de066863ca5100503aa8cf3c22f4327870341b89589c035590dc26759285b694451596f1d74145d87c30600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373218, "uuid": "c3840d77-439c-4364-8fd7-bf9e3917346b", "value": "T13215F0442306EE52E0D68BF7B8B0D37433A40DCF78E6D2A65FE56FE734193916958282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373218, "uuid": "a2118f26-9b84-487a-b81b-6ef6cf5fc41e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373218, "uuid": "1294cf14-a778-407d-ab9e-2e1030d00ffd", "value": "12288:tRxxltnn0gp36bQuFDJSZ9mzR5e356rVP7mym8Z2vVGlpX+C+nPQbL5n1WtBgfxW:Dp50UPuFVSn2fTMM2vVGj+Zoh0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373218, "uuid": "ea5f3162-2df8-4ff3-9337-8bd9f90a5382", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373218, "uuid": "e583ee96-f627-4c52-8c2d-4fbe6a8c2883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373218, "uuid": "b95bfd3f-05dd-452b-a9a7-5a89b90115b3", "value": "4a1b87430fe4ad7a1e9a35d99f7c612e7f2d8dce339edd172753aee1632653cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c68b706-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368369, "uuid": "2cc2da6b-0dc6-451f-8e45-37a6c70b6fdc", "comment": "Malware payload (Formbook)", "value": "8622a2945b38dc8a5f2d72d59a936729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368369, "uuid": "d15ba99f-a841-40cb-afe8-e9f7cade839a", "comment": "Malware payload (Formbook)", "value": "4a37a938e5bb17c3b575428e2e9916ee5bab02f8eab91c298bbfbc08f64619cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368369, "uuid": "941841c6-1369-4be7-a65f-40a42fe04108", "comment": "Malware payload (Formbook)", "value": "2cae375f93ceddca69e1f3b86669da5d1d6866e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368369, "uuid": "7952914f-045b-4559-9ab4-fa575f268535", "comment": "Malware payload (Formbook)", "value": "c999fa9a502fe981f8a1abfec7c1dfa63044b826fec52614c445a862f79b079690a84f6e3d9d7b783ed5a5ed18c1ae7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368369, "uuid": "9f12fc6e-003f-4353-9c58-cade980bd685", "value": "T1CC3512C03739B71ADE601931A635EDB542FA1EA87001FAE25DDD7B8B79AE2119D0CF01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368369, "uuid": "0f5d5c21-aec0-4462-adbf-c389daa3f160", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368369, "uuid": "e39a6e52-568e-466e-96d0-ec4c62ecf5ee", "value": "24576:a1B68MwCXZCapX0NAUGd/qfHP2sAHUF0txyKv1:akwCJZd0Bi/sHPJA0FPKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368369, "uuid": "dacccfff-1bc4-4f3a-83bf-118aa99c925b", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368369, "uuid": "9fdb6ee8-34df-42e3-875f-75b1c9fe1ef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368369, "uuid": "6f0c64eb-063f-4fc1-ae9a-8acce3e55e68", "value": "4a37a938e5bb17c3b575428e2e9916ee5bab02f8eab91c298bbfbc08f64619cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97210d87-9465-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786329947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329947, "uuid": "79b51e6d-f50e-436b-b413-c63eaacd79e2", "comment": "Malware payload (Mirai)", "value": "2a33bd8a38db1eabf63f06745c785ea8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329947, "uuid": "10840f26-4af4-4a2f-8127-12611d145fc5", "comment": "Malware payload (Mirai)", "value": "4a5fa9b54c1531a1061c3c9f41e8f68e355c3f5cfce9877da2f5c754c0b108f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329947, "uuid": "18f33ac0-fc55-4b10-babc-f3e76abafa2e", "comment": "Malware payload (Mirai)", "value": "cb79072efe24e2aa8ef59e5f57e350b93fdc2069", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329947, "uuid": "d170a466-1caf-42a8-ba2c-81d08733558b", "comment": "Malware payload (Mirai)", "value": "2695017f26728f91b98126dda63f5eaaa6d320ebf4a0276d6c7930dc2ff55117dc7eb8ad4e453412ce7c9f4c32e61b4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329947, "uuid": "33a2b5e2-d08b-48dd-95ed-470d497f10eb", "value": "T19AB43B51FC419BA6C6D12ABFFF5E828C732317B8E2DE71129D155B2173CB85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329947, "uuid": "4cf87061-30ec-4c65-b628-87b54db08499", "value": "12288:eZqx3crcbwYjEieDmIe/dzQozr4mKVt6cP4uDmJibHe:9cfuIiPH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786329947, "uuid": "ca085cd3-7a06-4827-b5ac-1b8dcc1c470a", "value": 516960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786329947, "uuid": "81d25919-5820-4788-9ac7-7fab940dd531", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329947, "uuid": "dac34996-be2c-465d-8955-69635918a8e1", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dffea022-9471-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786335223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335223, "uuid": "61bfddbc-d027-47c5-82ef-3f3c60e37b47", "comment": "Malware payload", "value": "65eeeba00aad4a238ba0e8e7622d8b55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335223, "uuid": "42654cd0-1001-474f-b494-be4bdc7b2d49", "comment": "Malware payload", "value": "4a70a4a775f5f056339e43bb8710863780a8ae9b59f991a392c2bacc31ad6865", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335223, "uuid": "c984fbb9-f49f-46d0-9a18-68c78787769a", "comment": "Malware payload", "value": "320d59828dfd74373f9f1206c5f383bf2c0c066f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335223, "uuid": "56451df0-68f4-4187-816a-a20d27bf5fc9", "comment": "Malware payload", "value": "565c6be42ba5c40c501762755cd4da174c15a7087ce047580fa2641779b9731a545cb477fc5744b0db9ea3daf4c86b2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335223, "uuid": "22148bdd-5a60-4c9c-b709-2678505cf826", "value": "T1BA53F723FF0C4017D49369380A3B47EDB311BE5160BA9516330A6B6F2776E316687BDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335223, "uuid": "3f912a6d-5b74-4e04-bb02-c88246c793fb", "value": "1536:/2YS4750CSFKbTDl31QfywSX/IwPf2H3oH:/xS4750VIbTDlwyTX/Iwm3oH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786335223, "uuid": "fa5efba6-4b2b-4240-a6eb-64646d31c898", "value": 66456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786335223, "uuid": "2e07dd14-3dc5-43e4-9dcb-3bc06f9834ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335223, "uuid": "4f33d022-56d4-4c81-8864-b492d1db81db", "value": "4a70a4a775f5f056339e43bb8710863780a8ae9b59f991a392c2bacc31ad6865.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df937485-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786373018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373018, "uuid": "3f7279d9-3c88-4ddc-912d-3e8e94f83def", "comment": "Malware payload (GuLoader)", "value": "60dd7c6075cf1b57f917c6aa7d3260e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373018, "uuid": "c39b191a-85c6-4682-8a95-7ad633178d94", "comment": "Malware payload (GuLoader)", "value": "4afdcbb6f8a56d3a875a618e9d644922937d768a5b6956e2e8b7b8969238b39d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373018, "uuid": "0bfe1244-f159-4e74-9303-1935450bcd43", "comment": "Malware payload (GuLoader)", "value": "d9f149e9822abdeff6271904c2f50490596eb2d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373018, "uuid": "14197fb1-31ce-47ab-a21e-812b98b66c85", "comment": "Malware payload (GuLoader)", "value": "56f1ef76ec5cdd2d29d68fc39eb1fe9ba3127f17e29501df0d7a6f7e889514c9e6eb26aead6a365b09e96f9367ec5880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373018, "uuid": "455ada57-a301-45dd-99c5-0f76d3aee426", "value": "T1B644E106B3B6E267E56249310C72CFF1ABD97C166C906A0723B5335D1C76B81FE07A1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373018, "uuid": "d89a8d6f-cc68-41e3-9dc4-2719f1eed0e0", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373018, "uuid": "b81a4002-7cf0-4212-8617-3d95c7fcee0b", "value": "6144:pbfopygwAw3+D8oErNHXbetgN4C6RX4xDA:pbkn6+D8oMhigNqRXMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373018, "uuid": "0de556e0-8972-4196-acdb-51e77185c951", "value": 257151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373018, "uuid": "50ca8a0b-1e43-4652-90e4-ca4ea60c5729", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373018, "uuid": "831c9d7f-eb86-4342-8172-e313128e42eb", "value": "4afdcbb6f8a56d3a875a618e9d644922937d768a5b6956e2e8b7b8969238b39d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5d71d4-949d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786353818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353818, "uuid": "c5168620-c143-4efd-8a8c-e2c5847686e4", "comment": "Malware payload (Mirai)", "value": "e4a5aebc9b45c2554030a20ff3d02ea0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353818, "uuid": "218390fd-8378-4476-ae29-eca4548c264d", "comment": "Malware payload (Mirai)", "value": "4ba7a1e09e8d4dc9c9d45ab68ef7a6fb62543f8eca79767daae6ce258b249d4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353818, "uuid": "74595a05-17d8-48d3-9a46-b3cd0df59ec7", "comment": "Malware payload (Mirai)", "value": "6135033dceca1d9ace7584855a13ea7bf9e8939d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353818, "uuid": "8743ea98-eb16-4eb2-8692-cc6eb6c8ec87", "comment": "Malware payload (Mirai)", "value": "c31137ee0ee8054873a5a3cae87cb7236f3727a555bbb5b663fcc494bd7f7c2b4279cdb8c58555031be26344bab7bd66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353818, "uuid": "86798b63-c7df-4dc2-bfa1-63ce5d6a94a8", "value": "T1E8142A83B905DEF6F40EAB7204D30B257231BB660A531A32B31779799E3A2D4346BF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353818, "uuid": "60415bcf-3c0e-4382-8692-a7eb8a0862ce", "value": "3072:Sv2547RM8GI7y/SO8xngYKzGcefaJBw3LNhzVRFV9v6BG7oxXkm2CLf5QwD:c+4y+y/D8xngdGcCLpRFV9v6BG7oxXkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353818, "uuid": "aa3ed838-50fe-4b03-9bb6-93b9740bd71e", "value": 191618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353818, "uuid": "ea09251b-e9f4-417d-9979-33ecdbcfd676", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353818, "uuid": "3a56aa7d-b8cd-4996-ba4d-293e539c57b4", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf523ce-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339912, "uuid": "2817c63a-8e5f-41ef-ab4c-f1ea640a1c89", "comment": "Malware payload (Mirai)", "value": "3b251c8c34fca41217b651e009002f80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339912, "uuid": "48e9006a-3737-41a2-a41c-e5658b6ae07f", "comment": "Malware payload (Mirai)", "value": "4bf680cfc7e35d7a82c8b66816fdceb255cd2957f07026667b1d95c9382c35a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339912, "uuid": "dd79860b-498c-43fe-ba10-bf5f5f578547", "comment": "Malware payload (Mirai)", "value": "d94fc11ade533a3a5d6f4ed042c225322c0c7074", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339912, "uuid": "44f4d557-359c-4833-a3dd-d366f4219a53", "comment": "Malware payload (Mirai)", "value": "ba18208ab95d4023bf43c6d3c222ba4ca77317d516ddf4e88569e4b06a241203bb107f5f9a5aa45b264777df4fd7cace", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339912, "uuid": "704b9ded-eaf7-4bc9-83ba-9bf4ae8daae6", "value": "T1A074FC88B5F2E2CAD1D4EAB5B319784D37630736B1D77146A51EEA3323EF14809BD920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339912, "uuid": "416c5a6f-66d6-4479-8711-b769dcd137e0", "value": "6144:Da9d0a9Xa9dSg+RCsRTIS/CdUpZTh47jSdjZN9+ZCFHkE1:Da9d0a9Xa9dH+RCsv2UTpdl+ZC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339912, "uuid": "3856a80f-4055-4bfc-9a0f-959cdce2cc0f", "value": 365048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339912, "uuid": "04a28585-9987-459d-94d8-95a769eebe06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339912, "uuid": "7724a313-c563-449b-84f2-9d2d4714c588", "value": "pid.ar6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5934eab3-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786374081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374081, "uuid": "5b8ffb45-f1cf-4edc-a941-cf5e44aeb6ad", "comment": "Malware payload (AgentTesla)", "value": "2f94f771cb61ecadb6e12950ddd12b94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374081, "uuid": "7a80c74e-4539-4840-b353-68125864fedb", "comment": "Malware payload (AgentTesla)", "value": "4c1c31b13205ba0a39b7aa9949fab60a863cc9e54d13223a3b25d4a5b06d8140", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374081, "uuid": "8b2a4c87-2aa9-432e-979a-56fc18021a98", "comment": "Malware payload (AgentTesla)", "value": "3dd94d5abf38ef596d5116be19a85de7eebe6509", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374081, "uuid": "ebcfae7c-6099-42b3-9952-b5a266893f21", "comment": "Malware payload (AgentTesla)", "value": "2b99af319facbc4edba420b28da23d4991ae5eca9ab0521166d04f6ac58c7fc486b661fcf7c274e9277c293e6d2bf050", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374081, "uuid": "054bc330-5b1d-4f33-8bb7-1612d52cd7ec", "value": "T10A84CF9AFFB1F8D1C53C06704B76CA250632EF951A42472B2A54F26F3E726028D67F85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374081, "uuid": "eeaefdfb-28b7-406b-932c-16a0d8973315", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374081, "uuid": "734507ba-d48e-493d-a42e-3cef7fdf5147", "value": "6144:A+MvoJEiU4oWwomiaZvNOTTGi0a7QYy1l/jl3VhOed8eEVJZSKhvZX9:A+e4oWwomiaXO+ra/yb/VVhOlLIkX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374081, "uuid": "81a74674-62cb-480b-b73f-107c238893e3", "value": 391896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374081, "uuid": "249eb7d2-9e00-47af-8dac-bea40ba6cc9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374081, "uuid": "824cf90e-b0c8-4b94-ab4c-12a232bb2061", "value": "4c1c31b13205ba0a39b7aa9949fab60a863cc9e54d13223a3b25d4a5b06d8140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19400c48-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368820, "uuid": "2543354b-6737-4cf2-9164-664b2ec303f2", "comment": "Malware payload (Vidar)", "value": "1293e25783c2f9aae545eedc6f28c67f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368820, "uuid": "5543d63e-8616-492e-a13b-d404ce99316a", "comment": "Malware payload (Vidar)", "value": "4c2dfdc57b9b008ab4922e6a37e3393f658adddd9469dc096d24fe4a84520114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368820, "uuid": "551c997e-60b9-46cf-86aa-84965f2022d9", "comment": "Malware payload (Vidar)", "value": "7d2d21b70bcff0d48b3702a7ab7b0509332754e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368820, "uuid": "819d6756-a929-4f1a-b35d-78a79a17aabc", "comment": "Malware payload (Vidar)", "value": "4f6cadf56a2f12c4274738a634ed8e279ace4cc2a105f3b7afffd7e16a3dde9cf87ea7931e0f1e6f8aaaa40920293cb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368820, "uuid": "e7c2ed9c-96bd-4e40-9820-76567b004984", "value": "T189829545E15B9AD9C4D5C332635611AB66FC7C202232AB3FABDC9B7A0D42730E7442ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368820, "uuid": "b22fc026-2dc9-407d-ba4c-efc300b53263", "value": "de4da189dce4a2df3103d8e87a228861", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368820, "uuid": "8a7ba40b-857a-4f91-b016-495e97cd85d3", "value": "384:OXc/Q3iA0PKKUA4ijzoxfpUVPQB7HbxiL+eOC0y+1wKCHRIlx0:8c/QAP9uUdQFbxiL7OChAwKCxOx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368820, "uuid": "44b55f12-0f3c-49ef-ab07-a97f8e4cc39d", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368820, "uuid": "30b5b468-a7eb-4292-9697-4b5727965030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368820, "uuid": "ae98380b-4d6f-4cf3-b7bb-8c11093b5d37", "value": "4c2dfdc57b9b008ab4922e6a37e3393f658adddd9469dc096d24fe4a84520114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc32f46-9471-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786335219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335219, "uuid": "86d53275-859e-4fd7-9d60-4dbc062ccf5a", "comment": "Malware payload", "value": "3e69ee6c9e9904930bc04411b76f1e17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335219, "uuid": "db8b9f86-a33f-461f-8d30-0520c8108d38", "comment": "Malware payload", "value": "4c569b65106a60dcea42ac73ee32c15718af0f6fb7cca0f562c2db1413f2c2e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335219, "uuid": "11a4866e-6db9-4332-941c-32967de49ed2", "comment": "Malware payload", "value": "c821f254a17e3ee16250ede29100d2fa2a66301d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335219, "uuid": "0dd4d012-8c27-4928-8e7b-0d64b701ad6e", "comment": "Malware payload", "value": "09540fba729ab2a4f9ea476d81a5f3254ab9975c8750c28e17e999b88d1a8b82c6fe9c7caceb6042623367cba3cd1e69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335219, "uuid": "d54cb607-4283-4f41-ad61-6354a2a5bda9", "value": "T17163F823EE9179BBC40BDDB4466EC29204DB6CFAA3E5522A71F4169DBE7C30315C3588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335219, "uuid": "908fd1ba-2f30-4cce-9e93-c14cd3cf97e4", "value": "768:x/IWLHEMQcYxBogghSkPt0lUkH/5y5aes0wMz12aFU84/5zR7:d9QckhghSk2bfksZ0Rx2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786335219, "uuid": "e6e02f0d-cb63-4158-b581-54eeffe7731f", "value": 72960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786335219, "uuid": "cba53570-dbbb-481e-86c3-81fd89cff736", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335219, "uuid": "b027adb2-e633-4307-aa85-118613aa1d38", "value": "4c569b65106a60dcea42ac73ee32c15718af0f6fb7cca0f562c2db1413f2c2e8.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1579c925-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368814, "uuid": "faad85d1-5837-4f82-8415-ce58fbe0ca15", "comment": "Malware payload (Vidar)", "value": "d82e38f335b56549a357c8922a1a49c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368814, "uuid": "13e72708-abe2-42b2-9c1c-247f8718cc1e", "comment": "Malware payload (Vidar)", "value": "4c61382ef2223b54d43612e22747edccb7991a35660e7eed6c149c4bcfba163e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368814, "uuid": "bb6a3695-b9a0-4363-9ee2-55a27c292bf4", "comment": "Malware payload (Vidar)", "value": "e7a1002fa659bb33d6b3e59d934df1d0646d42cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368814, "uuid": "e99bea49-7544-4e4a-9c5c-f82a812d09f4", "comment": "Malware payload (Vidar)", "value": "bbd4a00b21279f86cad2f192e1ce2758f500341e839308114684da4e13310edda06df73349b7e334dc8478499eed5749", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368814, "uuid": "3a297c8e-a45e-4c4c-902e-87a1c0274be9", "value": "T147521A52B183F1BCD4A983B8DA5A267BCB20308417392FFF06ECC55567C2251A9B836D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368814, "uuid": "805d6ad5-2242-4d03-a987-14526cf0dd4b", "value": "9e59872e7b02a2d8c2cc19db69feafa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368814, "uuid": "3387f9ca-d95f-49f0-90c7-d3c17fb03116", "value": "384:O/ok7I7rG+nuRewEtfq8iwBrylfG/mlO:bgIXLubWfjFclvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368814, "uuid": "5f067671-9a16-4a83-8a43-9b7d841ff75d", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368814, "uuid": "e8d5661c-a5f5-4177-a82b-11a4428d4c34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368814, "uuid": "757c876d-4d42-43db-bd48-822f0209a409", "value": "4c61382ef2223b54d43612e22747edccb7991a35660e7eed6c149c4bcfba163e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354d027b-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372303, "uuid": "d8858ca7-d495-41cf-9057-fe1f07d2a264", "comment": "Malware payload (Formbook)", "value": "889b35545a9ffb3d9b5410e0b72dcbf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372303, "uuid": "96376b37-4637-47d9-a042-3ad7da1f4bb3", "comment": "Malware payload (Formbook)", "value": "4c8b29d0734ffb31f6811c8510aab950ae26ab49cff12bf8199933df10daa09d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372303, "uuid": "336c974b-c2af-41bf-a289-56c6a167c2b4", "comment": "Malware payload (Formbook)", "value": "4789d7e27873af76f5b8e23e35088c2202af196b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372303, "uuid": "0c4fbccd-10f2-4a30-9e5b-6ed4197cbd5e", "comment": "Malware payload (Formbook)", "value": "28ffa47543e9cfb8f67704080577d16fd5f66185a2b59a8b7aecce7e681ca2dd4177c897c583e0058d1698ef63bfe2f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372303, "uuid": "b80ca6ec-056c-421b-ac71-8ed6ea659eaa", "value": "T10B2512A47BE5DF15D9A50BF90874C03043706EAEA066E306CDD5EEDBB42FB6254682C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372303, "uuid": "febdde30-4ef4-4e04-8e04-76fa2e87f2d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372303, "uuid": "01067ed8-2c5f-4297-9828-5bea90637eb2", "value": "24576:2j/Og31Iw3GpiEsjgnIefOf0NeCsQf0hC7EG8O4fw49oL:8Pl3EEvew0jH7iPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372303, "uuid": "bef3cbf0-73f0-46c5-b139-fd54b563506e", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372303, "uuid": "62901331-972b-4e8b-be4d-98fc4683f670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372303, "uuid": "124202d1-670c-4ea3-a779-8f3866b37e69", "value": "4c8b29d0734ffb31f6811c8510aab950ae26ab49cff12bf8199933df10daa09d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ae4f6e-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786373944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373944, "uuid": "2cea6cf5-9e51-45fd-a8e4-67f853286317", "comment": "Malware payload (GuLoader)", "value": "ad3f54dc188882ed692b865923c19e72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373944, "uuid": "ea4c515e-6034-482d-b796-e8117f6c228a", "comment": "Malware payload (GuLoader)", "value": "4d5696c5f59664e09584c457d82e78b2fd7ac681431ee0d5656907d404d34551", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373944, "uuid": "23f9c608-9cee-42de-9993-f1e16fb8a0d3", "comment": "Malware payload (GuLoader)", "value": "7b1adc98fd65ba1221f9bfd1c6088a49ef081a83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373944, "uuid": "a8c63dad-93a2-40a7-89a7-6643ce930e84", "comment": "Malware payload (GuLoader)", "value": "e9fa5f81958da802aa31c229f3b2ec4cf731f0172816077dd66df8c3844db0f41f613b796f809c9b1bb69e598987b7ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373944, "uuid": "332fdd45-3b53-4f2d-8583-38710d865da4", "value": "T14F54CF2533B5E047E6923A31CE65E1F8A8196EA1ED1AE40733117F0FBD78F92DD49281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373944, "uuid": "244d0fd3-fd41-4a86-8e63-378807d31502", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373944, "uuid": "4eea29ff-6656-4a06-99b3-63c2c4fe2f5b", "value": "6144:Vbfopdha+pV8OJt1FQGYZVkFkMfNj0bKUK3voc:VbIc+p+O71FQJ4N0dSoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373944, "uuid": "53d82cb0-09e5-4dce-88e3-725544cb65bb", "value": 286704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373944, "uuid": "efd3b247-4baa-4edf-a9a6-1b5f72a0e819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373944, "uuid": "8c9bdb77-a74e-4c22-a424-50585e6d8e10", "value": "4d5696c5f59664e09584c457d82e78b2fd7ac681431ee0d5656907d404d34551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3103fecd-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368430, "uuid": "b35a393c-eb6a-4367-a7db-106bd633ae4f", "comment": "Malware payload (Formbook)", "value": "a9352ffbc427cabee5482eb91c00684a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368430, "uuid": "a7310748-92c8-40c6-9b56-607de2737b6b", "comment": "Malware payload (Formbook)", "value": "4d6e7f9441ab4ccd120dd621871c2f0dcd5d1a3679577fa0808c82b1cd434477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368430, "uuid": "a792dfc7-4e40-4d40-a8a8-01460a8d0785", "comment": "Malware payload (Formbook)", "value": "e4ad5357edc744354b1205462e1cd67d6d4fcf40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368430, "uuid": "b7ac1077-38de-4d21-9a21-b58cfb2b8261", "comment": "Malware payload (Formbook)", "value": "572efd447aefc4f5256a4ab2f3cb96337d6def2b18827214d5912eba82bbfd0cb1ec314f006a307ab5dcde303425dea6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368430, "uuid": "a062a9d6-6233-49ca-93e6-7afe80d2922a", "value": "T1A13501C43B29B71EDE6409349539EEB542F91E68B110BAD32EDD7B477AAD201AC0CF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368430, "uuid": "14a4d162-1d1c-4672-9b03-43d1896929e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368430, "uuid": "a084836c-af85-4c9d-9067-f69d50e1e8ab", "value": "24576:F1BSNaKw000jb9BqybVlzQCbaDyVfKo2Hy4vAEeBXRNua4i1:FyVLVRBjwDRo2Hy4YoDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368430, "uuid": "e8e6e407-0b72-45b9-8d3c-1307250eec66", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368430, "uuid": "cefda9b0-ce14-433a-b912-567d6ed7c41d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368430, "uuid": "c96fcb55-36ce-4888-ba6e-5f89611f4041", "value": "4d6e7f9441ab4ccd120dd621871c2f0dcd5d1a3679577fa0808c82b1cd434477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b31283-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786373268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373268, "uuid": "2d4b2e16-498e-4de3-9c34-d40895cacc7d", "comment": "Malware payload (GuLoader)", "value": "1c754ccbcd8b81e148b6bf1e8e1408fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373268, "uuid": "7b194a2b-2104-48f0-97fa-92e7fef415fe", "comment": "Malware payload (GuLoader)", "value": "4d88ce05409e52572b1e2b1e7471672f703472e410ad5b71c7fd13e6dafe01eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373268, "uuid": "e17eda5a-8b90-400b-a037-fbe1cf5c3640", "comment": "Malware payload (GuLoader)", "value": "052c6ddb0520d76e1c6005bef96e28e9e7e9638f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373268, "uuid": "9b6b4350-b3eb-457a-8dfc-57b50230f7f4", "comment": "Malware payload (GuLoader)", "value": "5783acfb53a4ef75d8b90ba0c965a2fe4c77edda2205df098182022bbcd59eff0982cfb5642e71751e4a6bee3193d996", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373268, "uuid": "2b0f736a-5655-4815-91e5-b07eee85b46e", "value": "T17CD402C0E7409C32C6908975CECB86A6C7997717D0BB85F2FE70B95E687392219DBE40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373268, "uuid": "67dc78c5-3d60-4120-adaf-fc22307e4437", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373268, "uuid": "8542c90a-1c4c-49cc-b40f-d3e530829f7b", "value": "12288:/TA580bdpG0uxWBn1R02Y43VKuEHV+nxTo8+sMX9dkmE2f0:/TA580bi0uxWF1R0P4lJLO8hmE28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373268, "uuid": "30569fa9-0551-41b0-b96c-63e5b445ff1a", "value": 612384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373268, "uuid": "f1914ad2-aab3-4447-83ba-dc8b3cb41a76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373268, "uuid": "01f2442a-ba9e-43a1-80da-b9c942750787", "value": "4d88ce05409e52572b1e2b1e7471672f703472e410ad5b71c7fd13e6dafe01eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa696608-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786372634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372634, "uuid": "3ce58d8c-61ad-40b1-8388-a82a889975c9", "comment": "Malware payload (RemcosRAT)", "value": "78b70273fc590fab5bd01c8ea21363be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372634, "uuid": "ac6d5727-ce16-40bf-ae51-a9ae2bdcfefe", "comment": "Malware payload (RemcosRAT)", "value": "4da2425b6d3677ff80e52dd880a6f718257ad3c15deb565cd947b6f3aa05a9eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372634, "uuid": "1c895027-0a7d-4441-8509-8badd50b0903", "comment": "Malware payload (RemcosRAT)", "value": "49cbf6c36dd5906bd73df3193d0f824e1664fbc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372634, "uuid": "4e78cdad-64c5-4213-b5c4-349bdab16cf8", "comment": "Malware payload (RemcosRAT)", "value": "cc260391bc158d39e0ef2dd91de1f36c1580bbcf58c4d096b4de8ea8255186a266f8d31a78f665215754ec05453f7f6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372634, "uuid": "67f5c5cf-20df-4d01-82e0-bdd2063a1eb7", "value": "T18D26AEB1A3C4E5A5C41EDA34D730E233C1727D224A75908E198AF706EFB69527BFA701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372634, "uuid": "79e34fb4-8f78-475d-9f98-b12885679cdb", "value": "307f7e81c25ffd921ae92e385bccaf0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372634, "uuid": "c66f826a-c8c3-46f0-b205-d81f6f55299d", "value": "98304:iXLDad9OX3peer4RENS0WkIwHyEo1q8lSJBQwLOSnY3hO+WJMvJrfpMa/RE6GUkH:cLDavQ3pew4RtRgyH1q8o23hzWJ+h/Pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372634, "uuid": "39ac5057-b7fc-42f8-8f5a-71eca855a898", "value": 4742144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372634, "uuid": "677aa9aa-72e4-4338-8ddc-7fb18f92a0f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372634, "uuid": "c48354b0-534f-42cb-affc-7bdce9ad0998", "value": "4da2425b6d3677ff80e52dd880a6f718257ad3c15deb565cd947b6f3aa05a9eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76192c0d-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786371982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371982, "uuid": "95d6c10b-a8f1-47f0-b5ff-d6662a1d111d", "comment": "Malware payload (MassLogger)", "value": "266b6c12172e30c15ca9ce5461f4fb6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371982, "uuid": "31f92d4b-931f-40da-8aac-86480c2a42d4", "comment": "Malware payload (MassLogger)", "value": "4da2ff70dd2722d2de10f8a942d7bc90a2894ae3847a0677b6687027cf7cd8d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371982, "uuid": "c7984b69-659e-40c7-aa5e-77e133209ad5", "comment": "Malware payload (MassLogger)", "value": "2da495c427eb233355b614d1a8e76252d7ccba5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371982, "uuid": "06417fe5-84f7-4188-9f3f-1a8bbca67a9f", "comment": "Malware payload (MassLogger)", "value": "dbe391336144dbb4b23cff1a7c0cdc235cc1d2bbd2ec72514ce2cc15c81668a0f36f9ef7293da636d321344fa51cdbc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371982, "uuid": "77a4ce8b-4c63-4dff-83d2-ac1f3ef207f8", "value": "T1DEE5AF46A3D40AE4D4E7DB30CA1A9733D2B1F86A0735974B0664C3462E77AA38F77325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371982, "uuid": "b124be1d-4501-4283-8258-cbf453963fa6", "value": "b0253ae8279600c3d8dc02919670baab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371982, "uuid": "95768104-4ca7-42d4-98f0-b2a937ae0dd2", "value": "49152:Fv0LbCUjseTJDNvbfdf+s6gFJXyQMg3qzdXOEh:y64UQrqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371982, "uuid": "cb4f6af2-164f-454c-b3fc-5ac0b0afab93", "value": 3257344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371982, "uuid": "7eb38cdc-c04e-4ee8-a91b-10a488128606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371982, "uuid": "fccf7ae1-6997-4501-810a-06900e80948d", "value": "4da2ff70dd2722d2de10f8a942d7bc90a2894ae3847a0677b6687027cf7cd8d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ac88e2-9491-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348980, "uuid": "b4844739-ea4a-4dd4-82ac-a01cbada9d0c", "comment": "Malware payload", "value": "26caa5498a6ed8aba343f3e41654b21e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348980, "uuid": "3d0c60c8-497e-4e18-8349-db68d61f64f0", "comment": "Malware payload", "value": "4dc2369cb6796f275656d26663f6d7a238e080f438ad0c45b03edf1d3db5ecad", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348980, "uuid": "fe7c1e69-b598-41c0-a627-0d4bf7da1d8d", "comment": "Malware payload", "value": "85b8a16954ed78b456022cfa30af3f16deacc78a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348980, "uuid": "dfdcb96f-b134-483f-9dc2-a0170084ec7a", "comment": "Malware payload", "value": "51bded65097f00f4f238dfbfa53bb22d8b0e1ec278148f7a71941dff25f8cc6af8cf7e438dc92124b9c663e2c59fe4e2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348980, "uuid": "abfc7f10-1933-47ab-b93a-548ccc71bb07", "value": "T1D7C27D956A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348980, "uuid": "e6d46108-e1b4-4563-8a88-147b0a45fbea", "value": "768:g8vCB+25j6es8Rd9FYpMSUpi+20qUpi+20YQX:g8l25JLd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348980, "uuid": "2246a7fc-8839-4965-b6ed-94fe750f235a", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348980, "uuid": "3d99d7b8-505e-4ce9-9f83-183259be7a05", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348980, "uuid": "e66a85f9-6a98-471f-9178-69fc3c1f4b3b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8508299-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786371315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371315, "uuid": "4ff7760f-5a90-4542-b072-0c1c9abf19a1", "comment": "Malware payload (AsyncRAT)", "value": "8ecc789f830f03f365c4a05cb6ee3f10", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371315, "uuid": "5c2b9004-94d3-4b55-95fd-c86276d42b8f", "comment": "Malware payload (AsyncRAT)", "value": "4dcd47adc6a3c061e6953153eb8b21511dd7c2c7d19968945521439c378a1a0a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371315, "uuid": "6071beda-dce3-4e3a-9b9d-c75a3a2cf15e", "comment": "Malware payload (AsyncRAT)", "value": "2211fc6b7cb4f569863c1ea11e31fd0e73c54781", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371315, "uuid": "8cb10b03-87a0-4c0a-940f-a5ed465cce52", "comment": "Malware payload (AsyncRAT)", "value": "9b00519e14bd578f9c17b347ae72cd7d2d3b09d6569bdededa0992a05940be691c47eb45427b24ce9ef29c5f647698fa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371315, "uuid": "79bc686a-506b-4047-b938-463f54ba321c", "value": "T13A150224B205E116C9996B340EB0F3B613F98EEEB502E2065FEDEDDF7926B014D15293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371315, "uuid": "8171d13c-df36-4218-917e-918c324b1948", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371315, "uuid": "aea01a6b-acab-4e97-a896-c97ad6af0744", "value": "24576:PV/qfWNC4CvjvT5q6kgyQJLP2C6BtFgYV:om2jr5dkgN9P2C6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371315, "uuid": "c6534086-5b46-47cd-a541-8656fe65fb32", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371315, "uuid": "5654b3ab-65f9-4ded-8f44-47855ba2e110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371315, "uuid": "e0d2a7b5-eb8e-46ee-a128-0273334af1f2", "value": "4dcd47adc6a3c061e6953153eb8b21511dd7c2c7d19968945521439c378a1a0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a115e388-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383651, "uuid": "7f2a970c-5d89-4385-b8f7-1384da9dd32e", "comment": "Malware payload (Mirai)", "value": "51de3e50a01f9703828c435d80d43d63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383651, "uuid": "96ce6606-14e6-44be-82c8-ba18853a6e16", "comment": "Malware payload (Mirai)", "value": "4e03e899954be97f141140e93d65a2c98878c29746951f618f08eac0a7229932", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383651, "uuid": "b8ce8bc6-c84d-4207-bf2f-6a937264b86c", "comment": "Malware payload (Mirai)", "value": "bed3ed22e9ce2f3c14076c5e45060531a6959c19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383651, "uuid": "b3acd1a3-0267-4fdf-b585-fca2158e00dd", "comment": "Malware payload (Mirai)", "value": "589aa45dddd792aa91da6c002094ac4c15c12e4ad160de84e83262f971c07ddad1ed0118b64e699069c0b2c84db5530c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383651, "uuid": "6b217f41-765b-4ba1-a074-85a9798dd8ba", "value": "T10034494B67608FE1E375D67006F38BA7A6E9269212D38545E37DDE007B6034C682FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383651, "uuid": "f7aa5ecd-af1f-4061-8164-efd1e6bb3db5", "value": "6144:/QUPVYr7IdHieFpsV2Qp8IS7Y6sDlGnTFbuiIgRk5:/QU9+eHgYkmTtni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383651, "uuid": "ca9e1637-6f60-4d40-9e9f-e89f4a69a120", "value": 249708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383651, "uuid": "bdbe7e5d-309d-4366-b032-40ae16276adf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383651, "uuid": "8ec8e576-3f24-46f6-9996-340c871c8e22", "value": "disconnectraw.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314d630b-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786356834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356834, "uuid": "94df791b-1b2a-470c-ba07-d13156612068", "comment": "Malware payload", "value": "39d39de0a921c8a04a64abaf340c5778", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356834, "uuid": "842a4931-7694-49c1-8465-e736e4cdcfa6", "comment": "Malware payload", "value": "4ea56e5f8ded92fc09031d4554cd9911d0564793aa8ef3335b8c4a78e876e5f7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356834, "uuid": "b395f5c3-c519-4078-92cf-fd763c2f6669", "comment": "Malware payload", "value": "4ca205b00be9f7d8c0bfd5b9232e2d8fada12800", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356834, "uuid": "deb31101-8d9b-4fe0-be64-efa388efeb99", "comment": "Malware payload", "value": "5d8cc4abab68f1405c5caeaa8c2ebe34bfe704c58fc5a91a91de096169bfd2249a65682fd2f4f9221299414db7fbba8c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356834, "uuid": "3a91fd2f-8415-41dc-bf40-fe1c41d43f58", "value": "T1923188C92253CA752DE2AD2B72B9581579C890911DE0AE079CDD3CF4C0CCF64B286B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356834, "uuid": "049a5e67-8756-48ba-b541-0ad05ec15c03", "value": "48:i7Y3wY3g7YvYY7YV8Yy7Y8YU7YZYc7YoYNU7YrYc7YvYU7Y+YJG97YjYs7YCYY7H:i7Y3wY3g7YvYY7YiYy7Y8YU7YZYc7Yo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356834, "uuid": "ef37fdf8-38b5-4818-8423-642bd31721a7", "value": 1831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356834, "uuid": "d8f81ea2-b27e-466b-a919-75687288915e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356834, "uuid": "fe801a51-11fd-4536-87c0-2d043993b83c", "value": "0x83911d24Fx.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389ff2a0-94ff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786395931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395931, "uuid": "28ed1654-ae7d-4bfe-bb97-01e69dd8a97e", "comment": "Malware payload (Mirai)", "value": "b486d3c9ff8a06738ef7551b51c68a12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395931, "uuid": "ce24a1ac-8bc2-4c5b-87c2-63bb350c0cde", "comment": "Malware payload (Mirai)", "value": "4ec1e7e5178b590c41ff1b14c79674749152976ac338d8f71761d0e5e26a73fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395931, "uuid": "4f5bfcfc-0354-42b9-96c5-44ef460b53f4", "comment": "Malware payload (Mirai)", "value": "d6fa8ea8167efc062e94a01c14a7bf3d4ce78aaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395931, "uuid": "15eeb3ea-ffc6-4297-85c7-38982398bfb7", "comment": "Malware payload (Mirai)", "value": "45e951be5f6ceff8f4e3d3a9aa2ca661d6143a54d47e6e4ba635afe67ba1ec1985e6766c3ad5bdea910a809fa6baa492", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395931, "uuid": "a928ca60-86cc-4729-978c-d05256315fbd", "value": "T16F935B89F783E0F0D94605B1116BF73E8735DE225024DE5ADB94FE76AC32A02E61A71C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395931, "uuid": "514490bf-4af8-47b3-915b-4e95170661e1", "value": "1536:Ady4e3iSuz2OcLa/MS8l5KXVll0qjMOUF31s49owxqJl99xoZFQVur:Ady4e3bh0/MSa5OVll05+BwKecVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395931, "uuid": "92568e30-2f5a-4150-84ef-d23a51361041", "value": 94972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395931, "uuid": "b93cc1a3-8a5a-4002-863b-3318664e937a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395931, "uuid": "6d1c5b7a-7faa-4f50-9a49-1654bea64f63", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd94d4d-94fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395775, "uuid": "d1c66c2b-fcad-4e22-9b21-f8cb812be84e", "comment": "Malware payload", "value": "d5c1d48f4f0f8de99d4f18859cd351aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395775, "uuid": "dccba6aa-5317-4fb1-9a01-c57b951edddf", "comment": "Malware payload", "value": "4f3769f20a26052921f7b6a50f0e6954f0faaa25ade2197b889e161184cacc8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395775, "uuid": "0ebcfcc0-7b7a-4e7d-af02-6c90ceda6c45", "comment": "Malware payload", "value": "55582df4a82bbdfc25915713214a43e9ca7accc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395775, "uuid": "767ed342-2809-4f27-ad6d-346eea07a055", "comment": "Malware payload", "value": "87a49bb998f4f3627ee715021397f386dc997ed50104a9dac5c5422bc91735b78b82e8863e3af3b73370bbb4eb8a0279", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395775, "uuid": "80a07dec-d5f3-404c-a0b3-7e39ebd00114", "value": "T168636CA9ED0E7941E2D5E335EB594BE1A12F3DB0C35680B37902718DC4EDADD8ED2205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395775, "uuid": "3f015ff8-55a1-4390-a476-4388bb06950b", "value": "1536:4qZmrwnI6HkNAASAlKHcXUWFIaQRjJDVUrO:wYkSdAc8XUWFIaQzDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395775, "uuid": "09c365e7-acf2-4951-92db-0f04dd0a1d5f", "value": 70720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395775, "uuid": "b5dd0fce-0b0a-46c3-afa2-5eaeb3e20c36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395775, "uuid": "89c3fabc-98cf-4e83-b6aa-fd043b6178ff", "value": "main.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f5f053-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369224, "uuid": "de0dfac9-878b-4cc1-805f-2fe417f6ff68", "comment": "Malware payload", "value": "9718d7ddecd0efc7c1951520a83064dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369224, "uuid": "a215bcfd-95b0-4fff-a42d-e171929e1212", "comment": "Malware payload", "value": "4f4d5c28ac76d77d4db7fad4d369ba245d8d0e5436c080ae03bf70ccfbd0e502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369224, "uuid": "51e76a1d-7525-4837-87f5-e2ff5454fe54", "comment": "Malware payload", "value": "d83f7b6d5dbe3f0230c3e2c8a8f9f8bd3cd07ec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369224, "uuid": "f8399431-25e6-4fc3-ad27-7210e1a85535", "comment": "Malware payload", "value": "c63562cb203b010a73ecc2f7e06725c42c8b23b8348814af7f1da4546bc055d18879acb20f94a5c499bc91f0353a44b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369224, "uuid": "e468bdc5-d67b-4028-b2b6-189cb86f9ce3", "value": "T18015023D5D8FAF52C97C0FBE806A45D82BF4C9079252E7272EE901F88F573E55862092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369224, "uuid": "14a9e361-2a48-4a5b-a160-ff9d4cbb11df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369224, "uuid": "dc7f7600-360e-4ecd-aaf5-8a7ff51990a8", "value": "12288:qM1FLKi/251339JCzll10/MLR/3a5py7okCmVALeuFWrcaW5lkQvddbY3kx:qMaie513NJC5HPxaXy1VALNUSTkQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369224, "uuid": "79ac8d06-8fc4-4b9b-a73c-39a19f957251", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369224, "uuid": "3ade8bb7-afb1-418e-b9b3-43a895bf3ff5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369224, "uuid": "6ccf6a23-81a7-498a-8772-d2b8a738f516", "value": "4f4d5c28ac76d77d4db7fad4d369ba245d8d0e5436c080ae03bf70ccfbd0e502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447171ce-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Tofsee)", "timestamp": 1786372328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372328, "uuid": "111d80bf-e5e2-4b7c-9a98-9374e956ec5e", "comment": "Malware payload (Tofsee)", "value": "fdf568de03be77fc258a7fc289cb95d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372328, "uuid": "ff7358f6-5215-426e-9afa-94cdc4e238da", "comment": "Malware payload (Tofsee)", "value": "4f4e1a4365a05565a07191af5b40cd40a08d8639ab17c1218bb53d74f0a1e513", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372328, "uuid": "6116d43b-f470-4b28-b031-e324e77ca224", "comment": "Malware payload (Tofsee)", "value": "74508edab82dcb241750f4f2c6447bfc8a547137", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372328, "uuid": "b19f96de-4a40-41d9-a79f-b98b47369a31", "comment": "Malware payload (Tofsee)", "value": "eba03b80417125dbfed607d0a138f9112295396245bcb482f02f6cc424816fac1956031856416712a7ee0a6a69c0044e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372328, "uuid": "4cbf5e83-e0c9-4354-ba9a-9ceb2b3c4a7e", "value": "T104E60133B24B653DE02E16396D7A9122543B6E71BD224E0F96E034ACCF3D1607DBA647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372328, "uuid": "e3f7ef23-0bc2-4621-81cc-f75764d4719d", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372328, "uuid": "f8aea408-3a15-4383-8661-b2a8582142f3", "value": "98304:EoJJqAluMjYszPgfcaEt2bmpRgrYVNljQ:HTlXUfbEt2frYVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372328, "uuid": "1c6786bb-6b32-4fa8-8388-f87aace27e1e", "value": 14526282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372328, "uuid": "a640ef23-92c1-4f0c-a889-78a161a1be76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372328, "uuid": "9e4e5602-c4ab-40bf-b3d7-c05144f75b9b", "value": "4f4e1a4365a05565a07191af5b40cd40a08d8639ab17c1218bb53d74f0a1e513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7434d0e4-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368972, "uuid": "f32e732a-09f0-419f-bf0a-4c80f38ed551", "comment": "Malware payload (Formbook)", "value": "55c5b8b7e155fb84cd169daa92eb58c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368972, "uuid": "d18bfc0d-5d6d-496e-93dc-c68c4473f1cd", "comment": "Malware payload (Formbook)", "value": "4f6eee9151521e78b72771738e7c5fb87d642a8fbb1ade70ba9710ceb4692aa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368972, "uuid": "a7c95f0e-0968-473e-b82f-564fe172f32c", "comment": "Malware payload (Formbook)", "value": "671b4d9e1e5011be0f970ef46bcdc3f38911a1e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368972, "uuid": "9428bd12-1f63-472c-9068-7ec7cb076ea7", "comment": "Malware payload (Formbook)", "value": "6c1f6ad3e79265fd3e46f03bc9ad72bf439e1ad769c1a43db0b4f8dc88269bf624bb32df8fcee558a5c0d01bbadcb2de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368972, "uuid": "4f7d409d-cfaf-46f9-ad19-4271c277c183", "value": "T17E3502592668CB06E4B74BF48972D2B447792EEDF822C20B5FD83EDFB83A7515100792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368972, "uuid": "017c231f-c489-44bc-8b70-eb5738678847", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368972, "uuid": "b44b26b1-ed45-471d-b953-ef7b97ef55a6", "value": "24576:Za6Uwy9TWyx9G4ufdQbjBsZpPSwbPCN20EqVjxGg0:Za69oTWyDG4SdQfBsHPfPOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368972, "uuid": "359a6524-8f35-409b-944b-0e7c200938ad", "value": 1100800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368972, "uuid": "bd9a3862-7e9f-4984-99cb-663e2ca10810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368972, "uuid": "27787a4e-c2f5-46d1-a1e3-d7261d37e132", "value": "4f6eee9151521e78b72771738e7c5fb87d642a8fbb1ade70ba9710ceb4692aa6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e407e71-94fa-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786393793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786393793, "uuid": "922a6649-57e5-472f-b6af-581796f7d0d8", "comment": "Malware payload", "value": "dce19b87c0a28ce08ce0d83a05a32603", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786393793, "uuid": "757d5f96-02fb-42bb-9703-eae72cb0ab09", "comment": "Malware payload", "value": "4f75ade0a9e46456e8380ad3e4df9d8619c117fb21e885cc56f84b5cdf01fdd2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786393793, "uuid": "a1171f99-0276-4fa1-a41b-334456592afb", "comment": "Malware payload", "value": "54c594ca3972bf7c9192968e455fdb73cd53fee1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786393793, "uuid": "40ff605f-1ab3-4b85-a933-934636f93270", "comment": "Malware payload", "value": "f56875bd1d380c7cdfb5082a6af4a2f2aca7bd91b35b40d4a1ea4ef4f4264244c90d42cfa13915b0f299fb2decd78362", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786393793, "uuid": "3b825c1d-6563-4bc2-9f2f-3313a255cec1", "value": "T195C28D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324D42AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786393793, "uuid": "3257b7cf-5348-49fd-9a50-dd4adee39cd8", "value": "768:98vCB+25j6es8RLH9FYpMSUpi+20qUpi+20YQX:98l25JNd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786393793, "uuid": "8949b23c-3b46-4cc6-96fa-14b3cb77a7ed", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786393793, "uuid": "9aad7dc7-7a4b-4755-8847-e9358254a57e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786393793, "uuid": "e6f51061-6043-4a13-bfe7-a0493fd47db4", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf39651d-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786372561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372561, "uuid": "3e400e2e-5e77-4b4d-bd51-13bd1b8751bf", "comment": "Malware payload (Vidar)", "value": "89e1c40de9b8d7533e9b6dcf1b72154d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372561, "uuid": "31e96f86-cd89-4145-bfc8-00a8bb24d369", "comment": "Malware payload (Vidar)", "value": "4fa82520da2885d66bfc4a58bf9db0b89822d0fbda2036f57426928308d903d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372561, "uuid": "dcf782c6-5363-4968-b5de-2783faed3ce9", "comment": "Malware payload (Vidar)", "value": "f33cf6bf6a5043b8f4d910481ceb29edab4ebf8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372561, "uuid": "0c11ee07-eca1-47bc-8103-6baa185d0e80", "comment": "Malware payload (Vidar)", "value": "197e8dad6fa636391e0a22290ea6bc4e59c076306d45976bc7253feebf526d70111e64a3828ff6ba5e521fa1caf8db1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372561, "uuid": "6c937c4b-45fe-4bf4-a5d9-d7711ab7a868", "value": "T121F58B177CD049F5C0A9A331C9A24282B775BC490B3573DB2EA0BB782E727D19D3AB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372561, "uuid": "4bb77799-8f5a-41dd-8173-4b2381072d05", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372561, "uuid": "d67ba045-c6ad-44bf-9154-e94e6ae571aa", "value": "49152:uG0d+dg1QsMlxlDAMhOqyzxRKM/T6DtoSVud2s9FsdAd3yZ+TQ:uGcixzcKM/mg2s9Fsda8QQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372561, "uuid": "00ae40d8-f8a0-4da6-8050-aef24bc039a1", "value": 3463520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372561, "uuid": "55ffe2a3-3b36-48a4-97f1-cba55a4d1ab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372561, "uuid": "b1d50751-ba40-491e-af2d-b027c03146f8", "value": "4fa82520da2885d66bfc4a58bf9db0b89822d0fbda2036f57426928308d903d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b714db14-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786345892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345892, "uuid": "40f7cf25-8feb-415f-9b4e-89d2e2ae4dd4", "comment": "Malware payload (Formbook)", "value": "7e7dd3809fb57309826d9a79c40d1241", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345892, "uuid": "5242ac5d-f2a4-4e21-a5c0-bf7268e4c326", "comment": "Malware payload (Formbook)", "value": "5013e61d66b8bddda613be42e2f3b3aacc6abd7159f54cd6b4d900da8e8dd404", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345892, "uuid": "925f80fb-e5ca-4df7-84ef-a31b15e69fdb", "comment": "Malware payload (Formbook)", "value": "09030be0d89d068b10dc93f4a3c0485b18c47011", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345892, "uuid": "7c560825-0a84-4bf3-9a6a-871ea4cf43f3", "comment": "Malware payload (Formbook)", "value": "60d379a84d4f74ddec03e3a0201683126312e2a96e777d598fac6e8d54fcbb4b0aad8ba52c00872acba666b03ab4a402", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345892, "uuid": "f8ace194-37e4-452d-b8b8-9e4d65adb9a5", "value": "T1BB53204495C379845333BBBFB62798E4E276076B01804A1BB87C7851AFF1D19DEE08B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345892, "uuid": "598bcbc3-5ac1-453e-8d02-39cdfcc0dc55", "value": "768:V6moRddz6eaJN6vFT9vSvWEz+TfKCd1gR8lCuntK0FB/CkzSFJX9W9L8tcRlT9h9:4mUdwRp4R0Sm3qHwiJPLQJCW6Oy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345892, "uuid": "8f77214a-d456-4210-a2eb-1751c59fc76a", "value": 65144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345892, "uuid": "11f485e4-dfca-4a74-b68a-e9fcd4badc77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345892, "uuid": "0324231c-6b4f-47a0-a363-b9c5ea0bc791", "value": "REQUEST FOR QUOTATION BALL VALVE (PCMSB P1TA19] RFP-000000186514- (PCM TA19 FH-SBH28-26274).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58d6bdd-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370881, "uuid": "486b9ccb-8482-4bc1-b827-9323e5375495", "comment": "Malware payload (Vidar)", "value": "1b9017f8899eb7c9c26e03b0b31f25a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370881, "uuid": "eda79193-8278-4da3-bc5d-a69d11efdf09", "comment": "Malware payload (Vidar)", "value": "504f0c1d10018ce7553b3be07e526186007562663eb0fba9bd172e4e7ba2bffb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370881, "uuid": "d7553c4d-0e0d-47b2-8a54-4ce45091657f", "comment": "Malware payload (Vidar)", "value": "36fcc12316b1f63faadf0d580f4de9066024da14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370881, "uuid": "5a4b0c60-3f90-4166-a30d-5266c4b51a05", "comment": "Malware payload (Vidar)", "value": "a1448e1301ffad3ce77012d90424a3017e130dd1193328e5f5625fbfc41a04a18234998f4cfd2e0cbcd8565d8492ab21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370881, "uuid": "55b0ffff-f8a2-4deb-8f20-d92d7c71e9ab", "value": "T1CB52F88BB2C325EAD169C3BDC9892396E7263094031E5FFF4DECC4AC769225025B8775", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370881, "uuid": "93721ada-05a8-4a76-b25a-1901e51d754f", "value": "1599d6927d08f88e02098ee396f7c0e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370881, "uuid": "8ef75051-7f03-4f2f-bb22-bfeeb5c41513", "value": "192:OEhwpVs+EOA3idOx+6tt2J3BI8mIA5kwXoOf/Fhke3VJV:OKExd36+BI8mHkwXTf/FnlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370881, "uuid": "00504822-9475-442e-a9ae-ac341a7eed8d", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370881, "uuid": "a8c949c6-2a9f-40b8-93e6-b732751210b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370881, "uuid": "68085420-3924-4663-8fe7-0c6f4e229173", "value": "504f0c1d10018ce7553b3be07e526186007562663eb0fba9bd172e4e7ba2bffb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3616a17-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373024, "uuid": "b46213c4-f108-480a-b0c2-8f8329cb4a7f", "comment": "Malware payload (AgentTesla)", "value": "4bf9a9e9707fe32320654e641adf62e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373024, "uuid": "48cfd323-a051-421b-8fb5-ba212e290968", "comment": "Malware payload (AgentTesla)", "value": "5069364f9e57856f2964c98fabfc09391f604c2a8a0136b2e486896b1d02e9b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373024, "uuid": "6e8063c8-e4f5-46d4-90d5-5ee4737cd8e3", "comment": "Malware payload (AgentTesla)", "value": "c8d77388cab373eebdfff42be7ec4a9fcce7bbe5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373024, "uuid": "eee2b562-d64c-4fae-96ca-3fff7aebeed6", "comment": "Malware payload (AgentTesla)", "value": "643bbe7596255365fc9829192abfa0a746224c8830474b248db9b5325a9c8fbd434753c3f914fd8ce494bb420ff7c039", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373024, "uuid": "a0bd7ba9-6e95-41bb-8d81-8a560481f3e1", "value": "T1812501541356DE02D1D69BF6AD60D77033A90DCFB9D2C3926FE62FFB781A3801858682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373024, "uuid": "1f765508-69cf-4f57-8d2a-b1abb2d0d8b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373024, "uuid": "b37aa0e2-ec23-4dce-9f0c-d767a2b65461", "value": "24576:Zyop5038YDQmy6aqZG64sCe1WL/4shUE3k6Tnv+O:7pfYQmyVjshELwP8Tv+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373024, "uuid": "62511601-bf8b-4042-9feb-a7f59c4ac074", "value": 1039872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373024, "uuid": "177071b9-0dfc-4403-bf48-664da92c2386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373024, "uuid": "1d1ddb11-2266-4cd8-961f-1a6e701f917b", "value": "5069364f9e57856f2964c98fabfc09391f604c2a8a0136b2e486896b1d02e9b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db45c622-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372581, "uuid": "a9dfa106-e1be-450e-93f3-80d165e7f4b2", "comment": "Malware payload (AgentTesla)", "value": "a8b5413fc8d0d4e9f3c634fca19ff5c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372581, "uuid": "622cae08-66ad-4a9c-921b-8be45cf3d035", "comment": "Malware payload (AgentTesla)", "value": "509b69fdf4262c2fedae688ca4645021391ed1f395e62faa398d52da8b1ce080", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372581, "uuid": "aa2a2ef0-513d-43f3-8824-1df9dc5bd344", "comment": "Malware payload (AgentTesla)", "value": "c90588d4f37291a0adc36385e6012580fc60cd04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372581, "uuid": "6e9d4d68-71b6-4db5-ba68-b9d349d2ee55", "comment": "Malware payload (AgentTesla)", "value": "0d1678314f8e65c70aa25297f3ba3bd62b987b3e2444bd27e47ab9862515f1f6efaf8f6f3dd95b1d6b937d4e5f342b47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372581, "uuid": "7b79ac67-6239-4f73-811b-752123f882e9", "value": "T158D5BE55A3D865E9D466CB348B15A232C2B27D634B75E08F0A8AF3061F779924F3F702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372581, "uuid": "f0831a8d-2ca2-41b5-9016-f13cf9dd7e77", "value": "592f2a4e38c27b54ff57db9c30b12a37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372581, "uuid": "5e887790-701b-43a6-8f62-303c70cb069c", "value": "49152:gn0H3utg0VfbSarFvELIjyFo12MzbYjmO3UGCxb+3qyF5IUAHu9ShrD70C+sW:0tg2fuaejmO3UGCxb+3qyF5IUAHu9Shw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372581, "uuid": "a7aad386-954c-4b17-a0df-51130f5eca37", "value": 2946048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372581, "uuid": "014f4168-b738-469a-97dc-277c4bb39732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372581, "uuid": "a43409da-eef2-479f-b350-eb3fd5102dac", "value": "509b69fdf4262c2fedae688ca4645021391ed1f395e62faa398d52da8b1ce080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d439ad4e-94f0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786389749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389749, "uuid": "8ccc098a-3c87-4ee1-a138-5dea3bccd943", "comment": "Malware payload", "value": "c9e10385ff907f6d02816e20447124fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389749, "uuid": "d6855318-9281-4f2c-ad2f-016e2d037429", "comment": "Malware payload", "value": "50cbc41dd30defda87d6639d231c4e9c3f646c9a5a172175f37249bfd04cd1f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389749, "uuid": "8328a15a-87ca-46c4-b929-5affc12fb591", "comment": "Malware payload", "value": "f7e4d179bb05ffa903cf37de6bb0cdfddea7a4c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389749, "uuid": "f465225e-8eb4-4ce3-b468-fd15ae3b1dc3", "comment": "Malware payload", "value": "3b64f2f991f76e993de85dc401bbf217ce8b62c5e7b59109e12c9c59b7e792123ce6fc2daf22c23a1e72b7569e1d9750", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wacatac", "colour": "#580106", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389749, "uuid": "c48e6b49-2e6b-4f44-9f81-a93334942dff", "value": "T100369E23B384A53EE4671E3A687FA649583F7A203A168D476BF40D5C4F396402D3B787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389749, "uuid": "b047c1c7-0e54-453a-bffe-2b270079f993", "value": "f6536c1d8abf1c4fa74c317ac43b14e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389749, "uuid": "ab293fea-f42d-4471-af48-55e33121de83", "value": "49152:Op1m50HttLVQWN2SIc3TS3UDhhv2Wn+F+KMmbyR7xYTG2sjMM3RQJhS333E4F:OvdHRh7Vhv2Wn+FYGa7xP2gRQJhS333T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786389749, "uuid": "04ac6da3-8387-4a39-b653-2256f866835d", "value": 5092864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786389749, "uuid": "80d2e09c-2257-495d-9605-481ad45287d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389749, "uuid": "c3a014ec-4eb2-41d0-9158-f8b09d33a40f", "value": "rq3w037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b59b0d-9465-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786329705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329705, "uuid": "1c0e211c-655e-4749-b2c4-c499514d5587", "comment": "Malware payload", "value": "b91f2918dd94a02b3fb7166204f33255", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329705, "uuid": "0b217e6a-3269-40f1-95a5-2209e4ec24bc", "comment": "Malware payload", "value": "50ee481e238a2b5719f66d41b7ce40ec0e791e34e3e0cba3bbd97a994401435d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329705, "uuid": "88cc2024-b1b9-4748-bde4-e9ad4f98bf71", "comment": "Malware payload", "value": "7dd9bbeca2490748f8aaa37e92e316a34bf16632", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329705, "uuid": "73b0603f-cee2-48ad-a58e-5bef35e8c019", "comment": "Malware payload", "value": "8b2e6453b6159e112d8379a300c8ea7b31873e2b8e1269a6e8aab2142bef4e96fa91110a06977f1077e8c8820d559cc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329705, "uuid": "42c6de27-5e3f-4dbc-8b2d-100d9529a5d6", "value": "T1EE530911EF0CA817C9666635A5372BA9F3A0B8D11170CD12B3053B6F16F3636AC87F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329705, "uuid": "ad6043ce-159a-4dd5-a62c-bbdd0b1681f5", "value": "1536:OCCfQZxXyV4NuVfLKO0FA5iThON3sPAXgS7zwOmSpOcoF:OCCfkyVNKO0FA5im8PAXgIwRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786329705, "uuid": "d553d61b-66b1-43ab-bacb-2ad09bf0562e", "value": 66616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786329705, "uuid": "d3f78186-7c9d-4ab5-a9f9-a4ce18b7fa16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329705, "uuid": "ec4ecd8d-ba3e-4e93-a955-5d032048dead", "value": "main.e6500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80f3600-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372066, "uuid": "00c62610-e202-471b-b169-af4889954742", "comment": "Malware payload (Formbook)", "value": "dec15a68f345ae5b818a1acb3317e5a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372066, "uuid": "a91730bf-a526-4b88-bbfd-bbd84ca4fb23", "comment": "Malware payload (Formbook)", "value": "511a8b81004d154c5232886ddda3aebb6387a503d695dee31d1094ad85f461f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372066, "uuid": "3f13ae6a-a7e4-4caf-a703-b17add02887d", "comment": "Malware payload (Formbook)", "value": "9653cf84f1155979719aecc68980689ec16af605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372066, "uuid": "b7e22a02-5ea5-459b-9ac1-99ce96594081", "comment": "Malware payload (Formbook)", "value": "731e6026b022d26f1881b13425567a2a8088691f4456455a0d2d72f99048f89d3e544841b6ab521b89f8bfc08ae06417", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372066, "uuid": "ab4e97c3-851c-49a3-9cdd-b6cd4230494e", "value": "T16C2523A6BBD2CA26C3C60B700D75DEB913B43DDDE961D3138BE8ECDB7560A603955220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372066, "uuid": "906a1163-b933-4217-9346-bf354523a733", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372066, "uuid": "559cc495-dc7a-4539-b8f8-54b4898987a5", "value": "24576:+j/Og3f3JWRPzLWYc9DvtYrbKmOkztFZbOo3qDuxZgXCEHCtRCK:UPhAmYc9D2rbVOkZXOo3qwZugR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372066, "uuid": "7731262b-8bcd-4dd1-a85f-573a1e8b7d78", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372066, "uuid": "e629d8e6-5930-41ad-98f1-cf32d7aef6d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372066, "uuid": "d2993668-273f-45da-a085-edb5e89ce81c", "value": "511a8b81004d154c5232886ddda3aebb6387a503d695dee31d1094ad85f461f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8ec4cb-94d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786377150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786377150, "uuid": "b23b4904-0ee0-4c38-b09d-26621a1839c8", "comment": "Malware payload (Efimer)", "value": "1a17595d3bb3a2b24d2fa35e4d6fc7c5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786377150, "uuid": "1c46c3f3-131f-43d2-9da9-d934bf0fdcb4", "comment": "Malware payload (Efimer)", "value": "5135843d806f71c346f1ad4fb9bb283f8667d4487782a8667cf38afb3fccfc7e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786377150, "uuid": "0d3a1656-5d4a-4933-bab3-e0811e9c13a2", "comment": "Malware payload (Efimer)", "value": "8fbd4c645cec835d3502fd8f5b63eaf3cbbdaedd", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786377150, "uuid": "210b7513-d5ad-4ecf-9e0b-0b450a765e92", "comment": "Malware payload (Efimer)", "value": "6f6ce328a86016e84b52ad3ad1d0d464690167f78103b356920f000af325dbe3285d045f6fb094e196c8aada8c83d659", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786377150, "uuid": "a60f1dfa-8336-4b06-925f-3d9f02751d07", "value": "T103E6334C2AE002FDE9A3B93CEAF2069AF4717CA21B34D9D7CBB841465E131C05EB9557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786377150, "uuid": "461a70a6-e2ee-4759-b8ec-63506af61781", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786377150, "uuid": "9ce9f678-6946-4564-94a4-e8e1af1543da", "value": "196608:SVVBZPJe7EyFmXRqquDJE7Fid7p9g66rCeMXMCHGLLc54i1wN+MoPIcu9KYK39sm:SVPbXoFKA9DXMCHWUjycuI3/PGTAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786377150, "uuid": "959991f3-0cbc-4d76-903e-166ef8416af6", "value": 14060327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786377150, "uuid": "0bc85a2d-9c1b-41a5-bdcc-89f125ef5fc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786377150, "uuid": "9c3b6fd6-59f0-48f9-a6af-b4d404889c9c", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f124b168-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370900, "uuid": "21754b12-88f7-4f60-b796-872181e3d313", "comment": "Malware payload (Vidar)", "value": "da58e7235489bca05f4fa5fd175f061c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370900, "uuid": "0fc22feb-be07-40e0-8a41-2079c9c54a61", "comment": "Malware payload (Vidar)", "value": "5139207fbf60b152f4bf99a45889703799b14ef1be7471db86d92298dab4dc09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370900, "uuid": "ce41cb77-bf2a-43db-b05a-b58a0214ba21", "comment": "Malware payload (Vidar)", "value": "ccd0ac8065f224b4491c5b50eea0de84b0db1afb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370900, "uuid": "4fa7fd55-c585-4e44-83ec-86c7b7cffda7", "comment": "Malware payload (Vidar)", "value": "a84bb106358f3a32dd92256abc6a97129b3fe4a9b57e923d7af2f1691bf41ae97ececcd94b98dc74817fcfd7c8635a62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370900, "uuid": "3dbe1973-9e2a-44d0-8df0-c37cde47a3af", "value": "T17A522BCAB1C361F4C0EDC37D8B5A12B7D6A6744113275BFF4BDC84B46EC1222A468A64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370900, "uuid": "c3e20327-c55d-40df-a9b7-e52cba7cac62", "value": "7f929b6102d2ed98f1e08cd46c6b439c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370900, "uuid": "63ed7ffb-989e-4c33-968e-c5e46cc04b89", "value": "192:OfTa5iYkl5i7olACK4p0AbaqeCUKXRso/Msr+lz3VT+6p:OfTa0YklAUl44qAb4TKX+o/MsylT+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370900, "uuid": "0ee14db2-8619-4bc7-a437-5ada5cd53e89", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370900, "uuid": "ab6a9812-f318-457c-bfe2-de4c2ef72fb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370900, "uuid": "4bfb7665-f81a-40ab-92d5-8464d4786c10", "value": "5139207fbf60b152f4bf99a45889703799b14ef1be7471db86d92298dab4dc09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7aec43e-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372522, "uuid": "07cb8939-e329-48f6-a42a-9e06d3c43d7a", "comment": "Malware payload", "value": "e492d127979d24d58947f9a607c03945", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372522, "uuid": "b64ecc6e-de97-491d-95e1-724028f98e1a", "comment": "Malware payload", "value": "51747e279a0f713ede309e044460188f38e93b2c9c2bcd4f73638492cd26ffcf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372522, "uuid": "1d92e689-7390-4643-a5b6-56bc7203f2a4", "comment": "Malware payload", "value": "205366f55e9880997b40a136d4eb683caea8366e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372522, "uuid": "88f615ea-a9b3-4840-9a47-971116e54e08", "comment": "Malware payload", "value": "e6102cef7f2e518a378a14e73c8eec9d1b09378d8404dc2dc284a983d8bba7fb80cc360eca70545f33050ba747cc72ee", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372522, "uuid": "8ad1dac3-db68-486b-80c2-285c7d409b41", "value": "T169315ECF10201A311042CA9E7BF73189B58EA1EB2D8FC3D498591EA993897CCF651F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372522, "uuid": "418e1a3e-e696-4506-9af1-367addab57a3", "value": "12:UU60DPclI6clC39VDb6KEWe0GBk6BNGF176F59cqFb6FKWpDR6DFSo6FS6OW6OpD:I2C39lEWe0ElMiiZYVc2aGAXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372522, "uuid": "f12cc449-9b7e-4cb1-9090-11c35cd75823", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372522, "uuid": "975f2d77-691f-4790-a6bd-a1200c4020b4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372522, "uuid": "3e956c0d-caff-4ec0-87b0-83e0ff1fde5a", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbb0bbb-9468-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786331377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331377, "uuid": "3c2b07c9-5b43-495d-b76e-a6784c678ca4", "comment": "Malware payload", "value": "0c07475851a9329d988f0059bdf160fe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331377, "uuid": "d4114eea-77e6-4ee5-abd3-c3c4ad20c589", "comment": "Malware payload", "value": "51e42cb2dd6ec6d9cf808eeda2cc6fa5cf8201e9e0e92345655368a9afae7edb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331377, "uuid": "3194d5e9-b112-4680-b002-3ab692653a54", "comment": "Malware payload", "value": "0cb1ad9633352b3d8eed4fe8af41514756867edd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786331377, "uuid": "9b15e35d-890b-4f22-a435-737857cd4362", "comment": "Malware payload", "value": "84820f29c56b698a8b71a190ec729db5c37266d92498a70c89c02adbaf460f8556f47470554d30bec28b679976bed25f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331377, "uuid": "c77d1376-a452-46b3-9d21-885a2b7aa421", "value": "T1C5B62347FA405F97C9A9417988D2C7B163F6E208E64247233BD89728FCBF2615F99C81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331377, "uuid": "35a14a83-afb7-4a05-a2d7-f768ab20496d", "value": "196608:dIvRNiY2tvHgwwa++T4jspYro3UNdqpri2sM5msk7xO7tpDjOAgnn:dIvRNUBy+T4j+kKY2f5MO7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786331377, "uuid": "ec2578e2-5662-4ac6-a1a5-5c4395877790", "value": 11131211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786331377, "uuid": "e8770f6c-6fde-4730-8547-756934ae6664", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786331377, "uuid": "61602ebb-5859-4116-ae1b-406774ea738b", "value": "promocioni3.php.1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d7f002-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786371767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371767, "uuid": "fedd51be-7cbd-4b24-bcf6-4a3a34eebdaa", "comment": "Malware payload (AsyncRAT)", "value": "cd6fa053ba911751efa2f530ef7ad13a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371767, "uuid": "141ea353-579f-4409-98d6-935d1202c7cf", "comment": "Malware payload (AsyncRAT)", "value": "5221f853cf61822c1e01fc25090a6599646c8430e5ad0858b405e46a3524b487", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371767, "uuid": "d0ca6c43-a0c0-4335-86b8-7d2ea6e4c84d", "comment": "Malware payload (AsyncRAT)", "value": "7c522d891eb1f468464e8bbbe9d3a57afa8800b4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371767, "uuid": "36c8afe2-f34a-4167-b06d-06af9010fa6e", "comment": "Malware payload (AsyncRAT)", "value": "4c828382b2e83418ae08069f0218227471de921f83c2667c07cc3cb5b0ba2db19c7f785ab06c5c0f03a611552f6dac31", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371767, "uuid": "fa0c99d6-9cd4-4512-8306-b0e302c9a733", "value": "T1BDF41259AA85DA07C15213345A66F37822BC2DE9EC00D7239FDE9DFFBA36E148D041C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371767, "uuid": "746a25d3-cca7-4ef0-b55d-14b23bf1e3c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371767, "uuid": "5dc342a6-7463-4ffe-906e-c9f0b6e8fcb9", "value": "12288:PlJdbnZ5uWIOAunM1ckpvt4vwH4CilII5sUUsGbm74kLziak94/PU:PhZ5XDAGAvevwH4CilIbUxkm74tJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371767, "uuid": "7469f9a2-7a65-41de-9ee2-4a6be50116a2", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371767, "uuid": "93e999aa-c4c6-4a48-93ee-2cc7ea6d3a94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371767, "uuid": "1e03587d-df13-49fe-8cf2-faf6bb3a761a", "value": "5221f853cf61822c1e01fc25090a6599646c8430e5ad0858b405e46a3524b487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e7021a-9501-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786396844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396844, "uuid": "4a51cd81-fd1d-4000-b5d7-0eea26147abd", "comment": "Malware payload", "value": "ffa76204740c899157a5062f46fdecaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396844, "uuid": "107ca33e-584b-4845-889c-b13526dc2f17", "comment": "Malware payload", "value": "5243e3702046dbe5d8ca9dd72c99df682d6637964adb4341e1a9a3394305e1f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396844, "uuid": "4d78bd44-9afd-4314-b409-08b5da9561f3", "comment": "Malware payload", "value": "04d5695fc1cae6f6bf044e816f3045430436bc60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786396844, "uuid": "7a4c67a2-f82a-4001-b09d-8ace2da4ef1a", "comment": "Malware payload", "value": "5e835aa7d11a6725cec939f3b418abf1e0c4491232f2a053d903a78c4bc67b0d352f6bf85353dc1844a1c65e5a31ea73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396844, "uuid": "e04fd09e-60b6-4f68-abac-a0b434ba5b70", "value": "T15FD35B33B70A9F63C63D52B54EF2CA3996E1265109E2A1956312DF0C7E312687C3EDE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396844, "uuid": "a6ca2dab-eab5-40ac-b488-84681a388861", "value": "1536:mU25TadM5aYTha4Jr2u4A+qiOnPX3MUDL1Sts5XzERQWWEyRFZ3d+rrFS2:cFaGr2RdDOP8UDLigXzAWP3wfFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786396844, "uuid": "32155907-3bf3-40ef-ba01-f5f03eb94cea", "value": 140296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786396844, "uuid": "097489da-4710-4477-9c72-44d7e3d48eda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786396844, "uuid": "c447d9ae-8781-40fb-b890-a47b42ac573d", "value": "main.mips64-n32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0900b72f-945e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786326702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326702, "uuid": "9941c4c5-1a51-43a7-828b-8d5bcff308d0", "comment": "Malware payload", "value": "12cd6a23db52223662a5a098ceaf0f02", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326702, "uuid": "b0f76b0c-cd0d-4bc4-b9bf-edef73a0724d", "comment": "Malware payload", "value": "5252a88bf7cdf43210cbf1f9e7d377b28c8f7f1393e653c03b7e6393dc6e376b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326702, "uuid": "ba41fc07-b90f-4726-bd19-121dc8e12841", "comment": "Malware payload", "value": "848b3ff0d3d7db733f7f21a36a2012024ccd53fc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786326702, "uuid": "0940b4fc-0fe5-4908-8da0-5747f441f8f4", "comment": "Malware payload", "value": "b9059fadbd28fd2e7b31fe40bde16eccc2c1cc25aea25ab161d17c470c27c984da765658ff514c5e2c4074af912a5aa5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326702, "uuid": "8b5c4b80-d91a-45b1-b189-7c7df0058165", "value": "T1BFC27C966A867C44BEC94A3E4CBD2B1D6DF5C3D1224942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326702, "uuid": "38b1bac4-bb4d-4b48-80c3-9b31d678cc5a", "value": "768:Cs8vCB+25j6es8R49FYpMSUpi+20qUpi+20YQX:98l25JOd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786326702, "uuid": "6c051b74-97de-4982-8525-ef3ea8e19417", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786326702, "uuid": "18e94f0a-07a1-448b-b03a-646c12b94ffa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786326702, "uuid": "6c9816b8-9bc6-46dc-bb29-a9209904b77f", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9782cc2b-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371609, "uuid": "d1f450cc-e5d4-42f9-8c32-a5499f8fc2b4", "comment": "Malware payload (AgentTesla)", "value": "b70d364d8d7fdb503b7f01f780566dca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371609, "uuid": "4e6f19dc-3c3e-4da9-90a0-982834324162", "comment": "Malware payload (AgentTesla)", "value": "52c40732892a9a76fb5d0541c9364e27ba184e516851d2395ed7fe23a867ec01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371609, "uuid": "9b95f9a9-7573-4769-a3b0-3a382b7d25c9", "comment": "Malware payload (AgentTesla)", "value": "48daeed7e8d1a6695effa910bba7d0d821a8f3f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371609, "uuid": "252098fc-9009-4007-8341-92f7b75c1bb1", "comment": "Malware payload (AgentTesla)", "value": "2a94d016e0cf085e45a4b1e2291ef0f432bf0a967d2d90566e45dddd56a9f763badabf85c1d6fa3e6ad39c6cfb1774e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371609, "uuid": "cb97a0e0-0c5d-4a33-9897-fc3dc0e570a6", "value": "T1322522186658E623C94117B52EB4F2742BBD2DE96800E52B5FEC7CEFBA33B148C541D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371609, "uuid": "b12e9ae1-6e15-4def-ba2c-98e8fddb4f2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371609, "uuid": "6ce387ed-65ba-4cde-8e8d-b43e3ada0926", "value": "24576:hV06pPSuqyjXF7AWi/KVsMyMC2Knu9QW5Ew0jyJGi0:JlSkjXFniiyMyMbWu2oEXun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371609, "uuid": "eafcebdd-5321-457b-b94e-f71fba6bb613", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371609, "uuid": "83fc8d35-134d-4e8b-bd92-725ff0e1dfa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371609, "uuid": "1f42b177-6187-468b-a9ac-d3fe586fb762", "value": "52c40732892a9a76fb5d0541c9364e27ba184e516851d2395ed7fe23a867ec01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b533111-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786370944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370944, "uuid": "da467cdc-02db-4b38-945c-5233d0761f3c", "comment": "Malware payload (njrat)", "value": "027d100f1dca3a4d9de8c40bbd60f4f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370944, "uuid": "18a6a6d3-1d5c-4b9d-96d0-1aceb0c91331", "comment": "Malware payload (njrat)", "value": "52c91de28d6269f6f1b20f7dc6054bf44ccf2e4da1355d71026e2c5b6d6cd0c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370944, "uuid": "079848f0-0ece-46aa-993d-e1febe629454", "comment": "Malware payload (njrat)", "value": "60e38277bf32e0fb5b47e7ec9e47cec9d57186ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370944, "uuid": "9cae2969-4456-410f-b359-cb1021c31b63", "comment": "Malware payload (njrat)", "value": "216666b9d19d6bf056b44d351a342fcfbfaf9ae5d3d8e7d1776c05e973b60fc14c8ab80529e8782fde07891152e65430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370944, "uuid": "014296d3-5a8f-4636-9a84-76a5624aee4a", "value": "T1C7150288321ADC02D5E26FB11E71E3B855B98D88A825E303DEFEBDD7B47D6463C44291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370944, "uuid": "c71c2912-289f-4de5-86f0-ce11b12433ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370944, "uuid": "9358c00d-3cda-4a6a-a71b-f7909a6072c2", "value": "24576:ZyIaRNQgDql+smIP6wXGvNZpFrP1lkR6pF:ZraQiqYsnP6wXeptEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370944, "uuid": "2d7e6460-e294-4426-98ab-bd1b9c0cfbfa", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370944, "uuid": "94565b8c-299a-4891-8aea-603d012ec9a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370944, "uuid": "5169fc54-daba-4f23-a172-da923cb2193b", "value": "52c91de28d6269f6f1b20f7dc6054bf44ccf2e4da1355d71026e2c5b6d6cd0c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287e177e-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369275, "uuid": "f2db1de4-8fcd-4789-8c94-5fd8457592df", "comment": "Malware payload (Vidar)", "value": "53df12e00344400d122deb2f6bb0f568", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369275, "uuid": "0f5fc09c-f640-4b1e-81d0-0807e2b9f4f2", "comment": "Malware payload (Vidar)", "value": "52fbd46392992db6e89f8c621c3d6481f1ef5ae27f5017504b5501945cd7d7ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369275, "uuid": "5858c123-83fa-4933-bf1c-b67e44127b2d", "comment": "Malware payload (Vidar)", "value": "8b7b3b01eb1f80c14e3aacc84703784021201c21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369275, "uuid": "67c20def-3b16-4882-92a4-c1896748d863", "comment": "Malware payload (Vidar)", "value": "d5c01920851f432c9d491647e13ca7a65d73c301e111a71ffc36db9da59cb31ace4f38e332adf45b410f7f1741731fd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369275, "uuid": "2394beac-712a-4a1f-8550-811fb45fdc68", "value": "T19D923F46D11B9AE4C4E5C337632A166765F8BC602131AA3B9BEC7A7A0D11370FB503ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369275, "uuid": "4c9d488c-7c2e-4105-9cd4-5a47e56a7eec", "value": "383dd58795248eb99a4152fc6e9be0d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369275, "uuid": "9fa55e39-ad49-45ec-af75-50049967f452", "value": "384:J/eQj/ex7Vv3QXcIz4RQH2NOIumNPU5Z6AadLMvsDPpxlw:JWQ/eP3ih4Rs3IoLLtqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369275, "uuid": "18a54dcc-2cd2-4d22-930b-29312b65d7f8", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369275, "uuid": "051d748f-1fc8-45de-a0df-98ea2f373c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369275, "uuid": "1635fc96-753e-4163-ba31-20cfe2edc067", "value": "52fbd46392992db6e89f8c621c3d6481f1ef5ae27f5017504b5501945cd7d7ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba4dc3c-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786373548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373548, "uuid": "d774d829-f96e-444b-8a85-fcbf30b534f4", "comment": "Malware payload (Efimer)", "value": "3dea6ebc3212e9410adcdae1c20abba0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373548, "uuid": "7bc61ce5-0e85-43a5-91db-012cfad81fa2", "comment": "Malware payload (Efimer)", "value": "530c05cb0ef409701e6d49e5bac0b1861ce6ea33fa3b86c199672e8624379cb7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373548, "uuid": "6cd2c663-5bb3-459b-a72a-29c7efdc5825", "comment": "Malware payload (Efimer)", "value": "abe0f3d8622dfe068fbaeee5e1e000d70dd92bba", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373548, "uuid": "716c4921-0cbb-489f-9f30-020bd8220258", "comment": "Malware payload (Efimer)", "value": "45706bd0a9edcf7bd4c54adad13985f4bf74f7e192aa82cc82f7dd59541befa212fe5a48b47597bb6bb5623361bba3f9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373548, "uuid": "e70bb6ac-2e41-46c7-818b-567ed9980534", "value": "T15BE6338D5AC413BDD9639434EAD201A5FC75B8745372CCDB0BB886513F2B2808ABB767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373548, "uuid": "8aae42df-9a48-49ee-b67a-1111d1bc3a6a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373548, "uuid": "4b813a23-c655-400e-a04b-678ad94363b3", "value": "393216:8WaWTDf3y7hP6AzL4mvXMCHWUjecuI3/PGTAI:8gfi796AzLfvXMb8TH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373548, "uuid": "c2b699ac-a0be-428a-a868-42a5bc84f9b3", "value": 14074595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373548, "uuid": "0e84b96c-194a-4b9b-a58d-adef88aa51b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373548, "uuid": "ced5655c-0a21-44eb-bfd9-05ea6945da5d", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d98c95e-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383591, "uuid": "23d3de1c-40a5-4cef-abe4-b7eab40ce49a", "comment": "Malware payload (Mirai)", "value": "993aea486757f50d2a960f70a2f3c44c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383591, "uuid": "2bd20f05-18ea-4e76-9077-20f835f6d3bb", "comment": "Malware payload (Mirai)", "value": "534351fca9e5792e7c114965bf76e4edd0087f591f6a8c251ad3486cfabd0354", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383591, "uuid": "f252c31d-177e-4beb-ab1d-4eb7e45d6176", "comment": "Malware payload (Mirai)", "value": "d78402d8ee8e8280e7774921b1280f84a067eff7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383591, "uuid": "1e38e33b-585c-4096-96da-34d88151bd33", "comment": "Malware payload (Mirai)", "value": "30ef1372c7a9539af1a0a978e5e6db18b6417705652c94b8431501fdebaf974ce635fa7888b441ec8df83495a56b9250", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383591, "uuid": "950cd873-a923-49d4-8415-469bcbc7625e", "value": "T17FF31955F880DE62C5D12A7AFA9E429C332307B8D3DA7102DD205F3977EB95A0B3B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383591, "uuid": "b9ffd015-9e5d-4c1e-8087-07c7bfb64787", "value": "3072:uxpOYOMD0EzfhJRhpIRYheEkmXy48cslyYBYG1sKoi:uxpRXJRhpIhEkmXy48cfLGiKoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383591, "uuid": "cb6c7245-c1b5-49a4-bf31-10c1ce4bfc1f", "value": 169628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383591, "uuid": "6bdce9c6-b589-4f9b-b322-b0b01fc6f8ff", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383591, "uuid": "a54e6fc6-af2e-4ea5-bc75-ac5db23c3513", "value": "disconnectraw.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4b9710-94cd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786374405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374405, "uuid": "780b91dd-f9e7-43dc-8fa4-9a181a2eaec1", "comment": "Malware payload", "value": "092273b7140ec66aa391ded63742dc79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374405, "uuid": "ba300174-1f79-4f44-9a0a-bc82728ebdef", "comment": "Malware payload", "value": "535eb88d35afcd8050dd928944ea5a7edaea2662d1333b76e49aaac42882c9d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374405, "uuid": "8415fb94-7bec-4f84-bdfb-1f51d8cb107f", "comment": "Malware payload", "value": "b3c719a3117c30b58d5e43ae495d2858d3db5b61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374405, "uuid": "4bde2cc2-18c0-4fbc-a396-a5198bdbb513", "comment": "Malware payload", "value": "5cc8ffb459d35b4abcfaae73a402adf5a58e2df854962cf8e915c6570acf9a86f4655183dfe6d9f6c66a3db87f657389", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374405, "uuid": "27cc141d-1d30-44c9-928c-4f659e00e19a", "value": "T11E77AEA3B252C473F5C250BA54ADE63B1728BD300B1516D7B3DC3A1A95706E27E3BA43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374405, "uuid": "a6d4a133-5f54-4ab4-aaca-e7c3cf8f72cc", "value": "d4aaa1b000dde1b92b1d40795a403529", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374405, "uuid": "309af184-0f09-42d6-8a23-4d507ba6bd4c", "value": "393216:C90YhxQX+0YCghOJf5rIPKk8XgSueAjR2sASt39W/yJsv6tWKFdu9C:/9X+01f5a/M34R2Wt3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374405, "uuid": "b1e9adef-317f-4b4e-bb6b-27706f369d95", "value": 34471936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374405, "uuid": "c93abcc3-8e73-40fd-b5eb-22c216439ac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374405, "uuid": "5749a0be-281a-41ae-8a5f-80db150c5af1", "value": "ada30fda2eb4b937a0101d9c533f49fb10fea29a72655d1696a850d6e2435dbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5715b92-9460-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786327904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327904, "uuid": "cc43703a-dc63-4572-ba9a-7184fd614931", "comment": "Malware payload", "value": "a440af32d4f66eb14aba1cbf90eaeb83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327904, "uuid": "739d59ec-78b8-423b-b2c7-3230c98afacc", "comment": "Malware payload", "value": "5417acf48dbfb04701be9fa60902059982e5f9febaebfeab1c9f51166b6fd144", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327904, "uuid": "a29dac09-9d5f-4e84-8b51-6ebb8d730463", "comment": "Malware payload", "value": "df230e3521762d165f89b489173d506adc5d49b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327904, "uuid": "8acf86b5-4054-469a-8bde-6c9b9e6d1f4d", "comment": "Malware payload", "value": "7bebbd029009478e272cd7f74a88043d52f8b97cf1855fc337eb6c3286dc99dcbd06eae5393717297b5666ae971697f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327904, "uuid": "4016dd5c-9177-42cf-9d3e-62d495daf749", "value": "T1FE63452A1A21FFFEE16E823047F39E7097556AD636E1C280E26CD7085F7028D185F7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327904, "uuid": "7d714d93-d007-48d8-b87e-23e73297dec9", "value": "1536:Jib+5AnryiihUgSgYpYvtc48d2hzTvawmJy77V2twXE:nKbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327904, "uuid": "0aafed6b-5fdf-415d-8eef-a0e011235c31", "value": 68432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327904, "uuid": "0fb6ef4f-eb1a-47f4-a920-245ca7a2ff9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327904, "uuid": "175ae35b-7666-421d-8912-a4eacaeeb9fb", "value": "main.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f7cc54-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "19eb016f-c95d-4d30-8b9c-a25e043c39e2", "comment": "Malware payload (Mirai)", "value": "9422d0b1d0cb55f2437571ad40233906", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "272bf461-7183-401a-a19e-e24dade626ec", "comment": "Malware payload (Mirai)", "value": "542af17c9ac5569bb8222ab211a9ada2d6a4ea7dc69c8c503a970c713e4fe11b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "91656ca3-e803-4e3a-88cb-4108165206cf", "comment": "Malware payload (Mirai)", "value": "a8e3befec4a93b29fe4eda6b6209e3e3c6f2093d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "e683ba59-f4e8-46bd-bd25-5ff3dedb7d4a", "comment": "Malware payload (Mirai)", "value": "bea6be8222e90d14776d8d3a48e63f54a5a2f5d11a67d1561e7c50e6d8548408d7da4833b8bac1de4b8522dcf96046d6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356948, "uuid": "419499a0-7f6d-4ccb-8937-e371800821fa", "value": "T12E049F73E8256FA8C2958174B0F48EB51B23969041876EFA66B2C3764047D8BFB1C7F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356948, "uuid": "9d79b25e-b91d-4637-9a18-7265d859b8b4", "value": "3072:mLznDMhnMN18lUXlwnsZIpoW5DL8Tpgo6s:mHRN18lUXl6zx5DYTio6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356948, "uuid": "2648b90f-d9a5-48e4-a93d-4755e454826f", "value": 180248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356948, "uuid": "5fbd0691-9df6-422b-9258-ee860111d63e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356948, "uuid": "8b5bbfa2-1ffe-4402-b81b-68da50120322", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2190f6-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372796, "uuid": "0be26ea7-4fac-4843-92eb-58447a945f4b", "comment": "Malware payload (AgentTesla)", "value": "81b1e0ad63253354ec88840c718dd164", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372796, "uuid": "e8ba634e-38d9-4c6c-9165-96ae27d51383", "comment": "Malware payload (AgentTesla)", "value": "54c1cbb6ad3d27f0987613748ad4d4778288bc812445b51e7af0771db17a4a20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372796, "uuid": "36977121-a2f2-4d48-ad42-737c08b05e9d", "comment": "Malware payload (AgentTesla)", "value": "ea5b6d302a2ca3a3c0eddc4a285bd4edee3f8e5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372796, "uuid": "3e5b9d96-30e7-43a8-831c-8073f680d1b3", "comment": "Malware payload (AgentTesla)", "value": "455a9a9b2eaa26bccd43e76ba7ad0ddc18f85c3101d748b4f7e76ae9e73edf6176b722044e684a79a4ee89e340ff1a63", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372796, "uuid": "a399d228-4fc3-42d9-b173-02b7930ffd1a", "value": "T1EE35F154171BD802D1D18BB7B8F0D37433A48ECB79D7C3865EEA6FA7391A7C25984282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372796, "uuid": "29aaeb8a-509f-487f-bb4f-cd8dcfbbd571", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372796, "uuid": "2268a94c-5c30-4cf4-b463-de2a6ef7b8b8", "value": "24576:sp50WE3WdYC0ViyoRIh9PexlFX4PoeoyHxrF//7A:spPdgViyuIh9PexlN4PJot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372796, "uuid": "a337040b-db2a-4c9a-9c9d-95c10283d857", "value": 1096192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372796, "uuid": "6355e7b0-b16d-4b23-af8c-0b27acd91084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372796, "uuid": "91307820-ce83-4754-9f43-540d72dd020d", "value": "54c1cbb6ad3d27f0987613748ad4d4778288bc812445b51e7af0771db17a4a20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d597e6-94fd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395039, "uuid": "d8aa7ffd-e47b-483a-aec4-d158b5841b0e", "comment": "Malware payload", "value": "e6f97b56011c419e8339e1b9b7b9c92b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395039, "uuid": "3e81aace-c592-480c-a3a5-730f8e0db7a2", "comment": "Malware payload", "value": "54d1d87a08600f28fcf8b9b64cee918e8cd65222c558b424503657f1cf0395c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395039, "uuid": "c62e0a3a-faa7-4ae8-9ffa-a96ca8d6a6e1", "comment": "Malware payload", "value": "b4d823f3bb9dcd81df4876d77e140e41682cea0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395039, "uuid": "c2acc801-2d43-411f-81b5-2b3fc6eacb1a", "comment": "Malware payload", "value": "a3ce5dc8c883dba4f679c652877e43d87064609dd116d0b90a3756e66f9063d523cc898a18c850af3aa64d3dde5f424a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395039, "uuid": "a4145376-ff02-4282-8235-85fa13a815d4", "value": "T129072233B66A613EE0EE4A355A72A232553B7E607C139D0A9AF4145CCF351A03E3F647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395039, "uuid": "fb6d0c93-53a1-4524-9ac4-877b8cd26e16", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395039, "uuid": "c9b80f11-79ff-43eb-a96f-6d22e8af20d3", "value": "98304:8AX7j334yOakxot8YZaG86HKCy/6uR4F0QWMgieJS8BNKVX6hlEd8AYEEFjE/HLY:7j37f86HKCc2F0QgJS8Bk7d8GEePk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395039, "uuid": "523d4a77-3d6f-42f2-a417-2d7fc2675ac7", "value": 16852380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395039, "uuid": "d658d773-da26-468a-93f8-3b2f422983ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395039, "uuid": "e0a67dc1-6da2-442b-b8a5-069f0f8cc8aa", "value": "app_launcher_setup_V8.10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65e1e8d-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786373862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373862, "uuid": "d8e8156c-3c62-44ec-82d2-a42e95872961", "comment": "Malware payload (CoinMiner)", "value": "b5a82328f57ded256ffc44f58da1541d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373862, "uuid": "aa72e478-a2eb-4454-a30e-cfc7723384bf", "comment": "Malware payload (CoinMiner)", "value": "54fa7e1901aebe02bf8935769ed66f6bbb750f2adfc1a2283eec2372bcef32be", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373862, "uuid": "14b09b51-1842-4a1d-b99b-5a2afd04c203", "comment": "Malware payload (CoinMiner)", "value": "bde49cf6e43fae18717a5da3bdbccf9c9cc666f3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373862, "uuid": "e762f3c1-b251-49d1-867a-128072a12eb1", "comment": "Malware payload (CoinMiner)", "value": "ed53de6754c826eba38e0b6c8aaa9f346db1eb0bd986f53dd1eaedca8490901675ded5a19c621a014477e76fdeb5e39c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373862, "uuid": "0a5eb410-52d0-40e2-a8d7-fcc9b1e0a816", "value": "T164D5238AD3AB64DCE4BA04B44D2105EEABB27B51CB17869F2397F53A1F126D0BC14F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373862, "uuid": "f46cba0a-0efd-441c-b865-e004069cc882", "value": "36dab651ebd71b404011f23a733060ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373862, "uuid": "603160a9-5cc9-49cd-94ee-7c082e210418", "value": "49152:kLXnKO43hkANtwJMZnyH3OfoF2CgcVJIGUXy83fyQ1krTY/H/u16Fgq1PFI:kbnJ43hrN+iZyH3O1CxVSGUC83fZ1kr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373862, "uuid": "a01da2f6-67e1-4767-9b55-5909d756c6d1", "value": 2754912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373862, "uuid": "19c0e991-9f85-43ee-8fb2-2e71b025b66f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373862, "uuid": "07c9c344-3b8d-47e5-b29e-fb005a46b26f", "value": "54fa7e1901aebe02bf8935769ed66f6bbb750f2adfc1a2283eec2372bcef32be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73c02c1-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368253, "uuid": "61acdb2f-89e8-4e2a-a552-b598e509456f", "comment": "Malware payload (Vidar)", "value": "111ae95b04f7ae6d6edde1b17cb21743", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368253, "uuid": "78bff842-3621-44e2-b92b-28122c337efe", "comment": "Malware payload (Vidar)", "value": "55cdf65aebe83a959784b637a9aa2828f7f532392bb5bb2f5ee0a3ee8844c325", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368253, "uuid": "36ee89b7-8a06-49c4-b599-ee10fe13cc87", "comment": "Malware payload (Vidar)", "value": "779dd9f734ee27721641cc1e3753f75bf456fc10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368253, "uuid": "7bea59dc-d326-436e-a2eb-e50ed55edb24", "comment": "Malware payload (Vidar)", "value": "b9f1c11dc7a78c5e830703c793ae2d610865b8e240f18d07ff116a236b71a22a83415e6ecb201154f27ad10ca768db89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368253, "uuid": "99011079-6fbe-41d3-9d06-1494e4a90f20", "value": "T11092B345E047AAE0C4E1C337A71A569719FCB82032359B3F5BED667A0D92370E7502EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368253, "uuid": "3a3f569c-0631-42a0-973f-384645bc21c0", "value": "11947076675cd2ccb7ede65c6ece700d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368253, "uuid": "daff632e-d231-4974-ba71-9b962b54ec95", "value": "384:O/sSk14cjVzRhFUEt+5aTmgyW8D0Tn3aqjaGbY9lYG:k2bE8TTmgGD0T3W7HY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368253, "uuid": "d11c43f7-b937-42a8-b381-ddb3ba21748f", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368253, "uuid": "2ea3db0c-434e-4498-85db-7b881d5022ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368253, "uuid": "3a232a28-8db6-41fc-82b6-df7bf159c8f4", "value": "55cdf65aebe83a959784b637a9aa2828f7f532392bb5bb2f5ee0a3ee8844c325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05bf3a33-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368787, "uuid": "7bf6e708-afe9-4341-a7bd-00f9b753944f", "comment": "Malware payload (Vidar)", "value": "bcbb74173b6d1ed18e0a5c5ef32beec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368787, "uuid": "68778ea2-b4f1-49aa-a9f4-b21c6d99adf8", "comment": "Malware payload (Vidar)", "value": "55e846717b5cca16f3b8fd0fdae97bafe5bc09871179a6778addb3a7f20ad79c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368787, "uuid": "272e47da-3192-45a7-b1f5-58f6293124c9", "comment": "Malware payload (Vidar)", "value": "df87a73d6f2e7659564d3935d8b7c8ee5a422b1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368787, "uuid": "b425fb3b-4356-4ad0-bf2f-d5d0b12430b3", "comment": "Malware payload (Vidar)", "value": "253cd1b886e4c30801d2ba373f6dd21fca08fc1cb7229da26133b305517cb6812965d3469c94c4a068e32a5c8fd6d1a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368787, "uuid": "019e29e7-e487-410d-baa8-d1f8e783ff27", "value": "T17E82A746E117D6E9C4D2C336631E026766FC7C1426359A7B9BDCA72A0E83370EB542EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368787, "uuid": "35a715b6-6df2-4d97-b9ab-765073c861fa", "value": "147d9559d7e86cc7d3c43b072d063583", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368787, "uuid": "06c53d61-c74a-4c7a-b2c2-91553aa687b4", "value": "384:OYiaGk6TY5qp+uy6rwPSdlT7V0+FeFmhRb5l:IJki44+IwKdlVFemt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368787, "uuid": "076c3533-86cb-4845-8b63-00c69498a874", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368787, "uuid": "38141d17-d757-45df-bb43-3a8c9377d407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368787, "uuid": "7d259c8c-a5c6-494d-b2a7-9078f684b6f8", "value": "55e846717b5cca16f3b8fd0fdae97bafe5bc09871179a6778addb3a7f20ad79c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6012adf7-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368939, "uuid": "d30f3346-0b09-4489-888e-e61352f49876", "comment": "Malware payload", "value": "bbd715166cc5c490261abfca20ae1673", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368939, "uuid": "cb06ee72-1a8b-4aab-98c5-2e7d3278294c", "comment": "Malware payload", "value": "56061e52e23cda852af251197747b8e1f70cdf84502ee0d4b16ece2e9e84aa2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368939, "uuid": "2d39be38-8b4d-4656-bda6-5afa549561d7", "comment": "Malware payload", "value": "8f5a6771c876abb1a1f9f302b2c2c9aad8ee8233", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368939, "uuid": "77ad1de8-918b-4ee9-96c2-774fe0c86a92", "comment": "Malware payload", "value": "96ff6e7928b2f2b497cca5a434a87b79ac852135cb4beec8ef4bb1e1f92cf3f068e5a52015c32dff595f071f1837d6b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368939, "uuid": "897aa953-2254-4722-9f17-c0b267a69f4b", "value": "T14A25F1161D8B6B55DA3D8F78C265498433F0D9035312EB5F2FFD10E6AEA2BC98D22067", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368939, "uuid": "8587227c-899d-417a-a4ee-6736a1f6e1bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368939, "uuid": "838c77b5-54f7-43af-9e89-b48798ba3ce4", "value": "12288:Hd8H7nebB5kODVKaZuCgHebdfSdkCmVALeuFWrcaWolkQvddbY3kAu:87nefksxDZsqVALNUSQkQOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368939, "uuid": "dd367339-958c-483a-95c6-ed1d4c348263", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368939, "uuid": "1622a939-7ac0-4324-bd14-630b5ac95bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368939, "uuid": "e8b0f6b3-6fc0-4d5f-9823-496b91c1fc01", "value": "56061e52e23cda852af251197747b8e1f70cdf84502ee0d4b16ece2e9e84aa2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d810c9-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786371545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371545, "uuid": "6bc6ecc6-a78f-4e14-97f3-2dbcf0def23c", "comment": "Malware payload (njrat)", "value": "0a4f21acbeddc2cdd799119504686b90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371545, "uuid": "d8f7ead6-b29b-4310-a346-07016edf95c5", "comment": "Malware payload (njrat)", "value": "5606772da0f42f2e5d4c69b6640b57aa187e0bfe10e61a15edba291135559253", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371545, "uuid": "f5b08495-026c-4486-a44d-7dac6a00139c", "comment": "Malware payload (njrat)", "value": "fbd0e56a588a4a57c8b45c7b6a6a3d39da1d43f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371545, "uuid": "d8f79d8f-d190-4f45-bb89-dd2fcb5f7b29", "comment": "Malware payload (njrat)", "value": "cf5b7cd03b4f9fb2882e3fc419364ad24c3d215afc204d73267cf98503a67f89988966366436b1b96021d51b6e069a60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371545, "uuid": "644c3cee-3581-4826-987e-f7e88cf40233", "value": "T12D15E1794AABF602C54116347D63F3B10B7D1EA8A4CAB1128FE77FEF7A72C5425110A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371545, "uuid": "208900c2-5c6e-4e0e-aefb-9898061b3138", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371545, "uuid": "c45178d0-6256-437a-842b-bd48d5f545c6", "value": "12288:1P/y1lJdbbyEZq00TituI3YI2x9+0d+FQAKPWa6hdgFymFw70IWAJ:1P/6p5aith1bgAahZFym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371545, "uuid": "155a8d53-caea-4b2a-a9ab-1d4a252148d2", "value": 935936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371545, "uuid": "74633278-fa06-4a98-895b-ae9afd590025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371545, "uuid": "c029b910-b1b8-4f86-982f-cd39bce2f459", "value": "5606772da0f42f2e5d4c69b6640b57aa187e0bfe10e61a15edba291135559253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8710fdc8-9493-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786349677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349677, "uuid": "92166aa7-cb69-44c4-89e2-c1c0e0a3c7cd", "comment": "Malware payload", "value": "a65eabb63a2885cbb783f7fc1ab1604b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349677, "uuid": "5ba59d04-84ab-468c-9ba4-306358b0824c", "comment": "Malware payload", "value": "563b54c72ce7e4bc83716b76b57ee3dbf21ae48d525dffcde2ae8090031465a1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349677, "uuid": "8e89d915-a87b-4207-94c4-2dd4a32f243a", "comment": "Malware payload", "value": "cb8ff12d27c42b8843a853880fb07e8b8a016efc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349677, "uuid": "f8d21d5f-7c16-4122-ae1d-8b82c8ed0c1c", "comment": "Malware payload", "value": "770d0310b5070ca3d464bbe10722db25ebba157191d6ff676bf76f91962615419784f670f32644ae4a8b84a490905f5a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349677, "uuid": "7a8633d0-f6c8-4fd9-8618-d905ecaa7cdb", "value": "T11E236D651A857C24AA98C4371D7E2F0CBDAD43E6324492DE7FCA3CF28C5AA9DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349677, "uuid": "56bb509b-c39c-4b3e-8fbd-85d0b1cc54d6", "value": "768:sXRWNGxV/9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:AlxKcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786349677, "uuid": "c9f31f58-e352-4d89-83d9-148bd61a9b9f", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786349677, "uuid": "87f14cec-5dfe-494c-9cd0-4f984faf44ef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349677, "uuid": "ba7212a5-6bb9-4527-a354-fe47de0ea65f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef306b7d-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373474, "uuid": "00b1dce8-4f57-4523-9fa2-0e5713f4eddb", "comment": "Malware payload (Formbook)", "value": "07b41dafc43bb6513dc40850e9b1762c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373474, "uuid": "15b924a3-0de1-4e7f-a9ac-359277f49d53", "comment": "Malware payload (Formbook)", "value": "566496a5d069886d1125076b4b9d0f728c306cc6989842daddadbe53db691e16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373474, "uuid": "04e47118-cd40-4a5d-8e27-50f0ca34ac3f", "comment": "Malware payload (Formbook)", "value": "2a398584f5542833d6119bf0a0c3c6df5ceb4603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373474, "uuid": "554c824c-d384-426f-a3d9-4f7b2e8b0ae3", "comment": "Malware payload (Formbook)", "value": "756d972c4fb38cc7f850e750afbd27a1a6e39330af7e3d3bf415f4905f69b6ae75a013fcc895f2e5a22f026358370c28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373474, "uuid": "a775c34a-4e89-4f40-9cc0-9b49eaed5bb1", "value": "T120542321EF1FA1CFE41B29B084EE9D8B2C40AE35015EDD679BC42D5D32AB1C473592A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373474, "uuid": "7fd5c3a2-dfd0-413d-9b47-d6bb73cb7b3f", "value": "6144:JmVDg55l77psgZ5I/NQiXwiY/mbEmSIxFHK:KGqLw3mbbSoFHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373474, "uuid": "7641909c-a8b8-403f-afdb-c92347c6a524", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373474, "uuid": "a633019d-a61a-4b6e-807c-a3ab02ef6b14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373474, "uuid": "bde7930e-59c8-4a8b-9630-8266b5209a57", "value": "566496a5d069886d1125076b4b9d0f728c306cc6989842daddadbe53db691e16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aca2984-94fd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395156, "uuid": "d6dd3678-b605-474b-9142-70e5d24d010a", "comment": "Malware payload", "value": "727bafb1b47d4696d628c2ea4ca3fb0e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395156, "uuid": "b3b1b044-4238-437d-af7b-17aafe7bdc59", "comment": "Malware payload", "value": "568d546ffe4d204289950f208306c8998a9fe58f98d5d33a81d2706471a1e6bc", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395156, "uuid": "9846902f-df1c-4e6f-b7cf-23480e976847", "comment": "Malware payload", "value": "2d709a82c45f74d5630553a9747ca92455c54674", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395156, "uuid": "75698af8-3deb-4fe7-b870-b6a5af087b24", "comment": "Malware payload", "value": "d83fc5c082d6ef23f6dd9d711e3e3668755cefabee4d1496fb559058e931e63d3542fa98fbcef02d3a1bbdc50d3521be", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395156, "uuid": "6dea2565-cce1-423a-93a3-d2754041f885", "value": "T1B1E6330C76D025EED9A3A53DECE111D2DA26B47207B6C8DB979843E2AD135E44C3E723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395156, "uuid": "dad7d4ca-ef1e-461e-be52-4084d6ea7666", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395156, "uuid": "644daee1-f92c-4708-8f15-043a821cf403", "value": "393216:HpZ3SUUO1TshtK9g8xXMCHWUjPcuI3/PGTAI:HpZCUmhtK9g8xXMb8EH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395156, "uuid": "c0c51759-95d4-40d1-81db-baf6600e0bfa", "value": 14028495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395156, "uuid": "6bdc62b9-de3e-40a6-b58f-b4998de542ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395156, "uuid": "6e4b0ea1-f8ad-4b53-a293-f0bee2e99b46", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6af71a2-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786339932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339932, "uuid": "e5bc0ea9-1596-48dc-8d4e-d8f3e89edcc0", "comment": "Malware payload", "value": "78e9eea9bfd9dcb0a7b854283f5b3558", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339932, "uuid": "ac184516-aab5-443f-89e2-b5589ad4b8a6", "comment": "Malware payload", "value": "56a5705a780f848faa55e8571d97f70b1462c2c2f3ccf0c6aa25ea8ec3f46cd6", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339932, "uuid": "8e489b68-d1d7-404c-89db-3bd36bc19355", "comment": "Malware payload", "value": "59d9388c1f087a45b1a30ebb1b896192b9dd97ee", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339932, "uuid": "246230d5-8686-4d87-a727-7ff2f237ee5d", "comment": "Malware payload", "value": "b776e06d5beaa9a112ad60218589f85e9f9411282f3ec9e22f911a3e95a72f8dfc4086f5705c28fd47529449f91d2e5d", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339932, "uuid": "aab7484e-5e36-446e-a38b-dffe3988251c", "value": "T152F024DCB1BCCFE10DADC88AF1F094004491A48BA1F46BD2F38D0A30AF54E8A396321D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339932, "uuid": "ea699f36-0f77-4a69-b426-dea228016075", "value": "6:vtmc4Fh5XAYVic4subid/n7owc4Fh5Xo4Fh5XjhHArGHbiOLxGzWiFMxFraF2vcj:FzY8id/7PAC7ikxGWi2jX7k+XAwALnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339932, "uuid": "b345978c-c35a-4422-9e2f-67ed2e6979ca", "value": 627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339932, "uuid": "1c0c5225-1843-4c64-a49e-3f423a4680db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339932, "uuid": "03f2f3b6-b3c4-4d82-a45e-a2a82c3fe873", "value": "payload.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ed8a34-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1786373938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373938, "uuid": "39ed7e1f-d126-42bb-8c08-aa154cbcf979", "comment": "Malware payload (DarkTortilla)", "value": "8bb96022e87f0b2934b237195cc00b2d", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373938, "uuid": "6d32639d-70a2-49be-829b-76241f1b4695", "comment": "Malware payload (DarkTortilla)", "value": "56c4a323f13dcfba07b6ec718b6f0f29d4d82a8df3dcbfdab3410b77b3b3afeb", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373938, "uuid": "3e003ed9-d593-483a-87e7-5e6c93d90255", "comment": "Malware payload (DarkTortilla)", "value": "db06c2d01626544f66cc971e5a01c1b504b7ff50", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373938, "uuid": "4dba6c21-e418-4300-b01f-5b7e984f5d1d", "comment": "Malware payload (DarkTortilla)", "value": "b9c9e4a97a9ba9377268f36271d9159e4b38fa1eb3a3c6c7493a0f4bb008730139adfcf8bc2e32384633b744f8988a3a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373938, "uuid": "d690294d-eed3-401f-9d5e-d4d1d833e4b0", "value": "T1B235023E6FC32F65D5BD4639A175008813F0A60F1242FB5B2FD912EDAF53A4E8607686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373938, "uuid": "9f0cb5d9-759a-418a-8476-46c62b2080c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373938, "uuid": "153f2e1e-4ecd-4fd8-ab57-e50a9306ee24", "value": "12288:4zb1yS6nRZFoGlHV7+myiYkt8OK/DiJdPRpqTkKp/pzS7bTcQw+CtBsVM1B:4zZyxRZFHZyiYl/DiJlGX/UbYx5BsVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373938, "uuid": "b36d7574-c01f-4dc1-ab7c-d33ada57aecf", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373938, "uuid": "9277af37-adc8-4985-a03a-cbafa3d1c7bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373938, "uuid": "3d4179ea-51f1-4f76-b697-42a4dc3cdc30", "value": "56c4a323f13dcfba07b6ec718b6f0f29d4d82a8df3dcbfdab3410b77b3b3afeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63907590-94e6-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786385265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385265, "uuid": "f8234278-0531-47af-98cd-3c5a83b11380", "comment": "Malware payload (ConnectWise)", "value": "5d7a3ab13de85fe631512de70fab6264", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385265, "uuid": "90be36d0-e6fc-4086-b350-a31d92cbc26b", "comment": "Malware payload (ConnectWise)", "value": "56cbbf481154a08fbfec54484ca04f6045dfe0e2fc082c6249592ecc4aaf1c5e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385265, "uuid": "be797dc0-4c51-4043-8402-07f53b87cf78", "comment": "Malware payload (ConnectWise)", "value": "f97ee17831571415fa84f251f32714225d111c3f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786385265, "uuid": "0c2ccd11-22da-4aff-adae-1defcc893810", "comment": "Malware payload (ConnectWise)", "value": "6a4681bae12c92917d3c72a3738896407fcc1fa5481ac2cd475ba230ffb310ee2b97f79f447a8ed60163f982836f9d3c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385265, "uuid": "d41de69d-d31b-4e59-874b-919c18ae54cf", "value": "T125834A53B5E18476E9720E3118B1D9B4593FBE110E648EAB3398423E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385265, "uuid": "687f2ba3-3f86-4ce1-9fd4-aac6420788b3", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385265, "uuid": "078b7e02-ad16-410a-a44b-bd2bdb1ed5aa", "value": "1536:6boFsMHqzISrGqx0WiwbqKHxfd6dldV0OCJRpsWr6cdYV7hsYYYK7Af:n9q8tC0C+axfdalBqRfbYRGYYYK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786385265, "uuid": "5efbbfa8-d368-4376-aa7a-452179a9b7d6", "value": 84216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786385265, "uuid": "80e4597b-4559-42a7-bad8-3b3e165ba255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786385265, "uuid": "6607335e-60f8-47c8-b55b-e7a9caddb1d6", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621bc3e1-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370660, "uuid": "73a4dade-77fd-4d95-9d0e-d30228b85e2e", "comment": "Malware payload (Formbook)", "value": "06dab69f3e53e03aeba5d95b52bdf541", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370660, "uuid": "625e3f4e-491e-4769-83f4-7d54fe290a36", "comment": "Malware payload (Formbook)", "value": "56e0ffb33535d3f0aa4ebd7bfaa2ed3269f1d0475c762e01ecdfcbdcf471f076", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370660, "uuid": "5fe9e476-bf04-4acc-8237-15a13754ac6d", "comment": "Malware payload (Formbook)", "value": "38aa56a54d34913f5ba85a7a4984055a7bdc4d00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370660, "uuid": "27759c92-115b-4886-9ece-2a8396369f00", "comment": "Malware payload (Formbook)", "value": "1a40ebc6f540a0f4b9042c58918c2bf0f5abbe1b78bf62f9643e9f9129e5e6867fd570b7817339bacebe26c978d69cef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370660, "uuid": "76c87b56-0d78-4f76-9346-924cd2c79224", "value": "T13B3512446A8AC904D5D70B34D4B4E3F843F27E9DE821C64B4FDCBEEB38667126848766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370660, "uuid": "317777b9-1a36-4bab-8a67-95ce5e414ca8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370660, "uuid": "d3d53f61-7676-49fa-bb07-b9b7d9a68169", "value": "24576:auri3r5ix8/4DUjk1D/+9MxCSY4cY4BSkYEhTxfm:pO3r5vA4jk9/+9MEocbBNLTxfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370660, "uuid": "0fef4f19-0aa7-4508-bf11-c97499362b83", "value": 1124864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370660, "uuid": "6a0f4fe9-230c-45b4-902c-7cabd3075e84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370660, "uuid": "08f52cbf-659b-480c-bd05-9949c645ef05", "value": "56e0ffb33535d3f0aa4ebd7bfaa2ed3269f1d0475c762e01ecdfcbdcf471f076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b744500-94e9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786386433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786386433, "uuid": "f174e8ac-c8a4-4839-82b5-e94c8028b275", "comment": "Malware payload (Prometei)", "value": "6111b9ba36527bbb8205bdda504016fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786386433, "uuid": "7b035f6b-49a5-4134-b595-f3fa7760171a", "comment": "Malware payload (Prometei)", "value": "572f2c1112a4d28df48372e34c092126f50379147478a3bce39477c2cb8b6181", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786386433, "uuid": "efa354be-2cad-43df-b31f-d6ba99169340", "comment": "Malware payload (Prometei)", "value": "59b1f14f3059e1faa08458060344c66aa2a81ca9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786386433, "uuid": "44af4d87-839a-4415-b609-7311f602ef31", "comment": "Malware payload (Prometei)", "value": "61f477855fa1cdf744958c7999be6318f6f597d2fa90a1a9c7de348ef124a4eef84727f2ab539f6e0f0f31c4c6f5fee2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786386433, "uuid": "d8251301-7403-42b9-90fa-81b40a0480f7", "value": "T18D37CF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786386433, "uuid": "1fcfbb9c-a953-4764-9b13-9580b4cbe0fd", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQD:cqYUQuVDt0TZEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786386433, "uuid": "de56ace6-6043-4472-b2a1-2a40fbb7e568", "value": 23265280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786386433, "uuid": "0241d553-62c0-4342-94ce-b8adf13bf946", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786386433, "uuid": "9b3139f0-16c1-4548-9be0-19c10f06d1c9", "value": "572f2c1112a4d28df48372e34c092126f50379147478a3bce39477c2cb8b6181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14600435-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786373107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373107, "uuid": "1a46a6c9-8bdb-4703-82f3-2d20979c5742", "comment": "Malware payload (MassLogger)", "value": "698dbd0f7705ed93ed8299d1fb4f4e6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373107, "uuid": "d0bd202d-6861-4f85-a9e8-59c4a4b721e5", "comment": "Malware payload (MassLogger)", "value": "576a0f67a8fcc0a2e3adb30cb59903699761d9a0d11d95d6620d443f8c625d4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373107, "uuid": "a91be767-dafe-42f5-9caf-3f6a38e8d488", "comment": "Malware payload (MassLogger)", "value": "cf825064935d1a766b7e05a7dd39f1098c4a5f61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373107, "uuid": "e155efc8-2efd-445d-9076-117dfeaf4e21", "comment": "Malware payload (MassLogger)", "value": "9f97c52cf82244a6f313b828461fc00b489ffa911fb968447ec5e64b56644cd16c0e64a50752e2ffd59ad00b1f6d1495", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373107, "uuid": "129aa78e-abe5-4d1b-b788-fb503f2ad566", "value": "T12D3501552356DD02E1E6C7F6B960D37432A80DCE39E2D3868FEA2FF7742A7C01954682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373107, "uuid": "927709de-407e-4314-8866-2d0f5c850e41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373107, "uuid": "25dc0fb5-1c8e-4f12-87e8-1f17e57241f9", "value": "24576:sJp50e5ddE+w2tnTZ/SRwgIxfykURCtXPqoCRgz:CpjLvnuIxqpRQ8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373107, "uuid": "48ce481a-96ea-4a24-a2ca-bca383073169", "value": 1068032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373107, "uuid": "ec1cd7d8-0fff-4039-8ee0-84d868ff28a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373107, "uuid": "a3b807ec-a8cc-4ea2-b89d-a264d2c15d8d", "value": "576a0f67a8fcc0a2e3adb30cb59903699761d9a0d11d95d6620d443f8c625d4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b843ec42-94e5-11f1-bd95-42010a9c0009", "comment": "Malware payload (SentinelRAT)", "timestamp": 1786384978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384978, "uuid": "e068367c-2079-4486-8d14-2544d0d0becd", "comment": "Malware payload (SentinelRAT)", "value": "ccdb449344ab0d621d22a5e3105600e9", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sentinelrat", "colour": "#FDBB9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384978, "uuid": "9f2826a8-f956-42a3-a930-5c0b76e283ac", "comment": "Malware payload (SentinelRAT)", "value": "588bcfbb76b4903eb7fee85b36c0bdf82dc597fccde71496c33c9340d7c6c47f", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sentinelrat", "colour": "#FDBB9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384978, "uuid": "19e12a3d-a88a-411e-899e-e0241af5d7a5", "comment": "Malware payload (SentinelRAT)", "value": "a9e4e47231100e051865b0eeb68dd5ce53103ab6", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sentinelrat", "colour": "#FDBB9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384978, "uuid": "d3285f08-de45-48f4-bebd-cb9467222c7e", "comment": "Malware payload (SentinelRAT)", "value": "447a09c9d98c38cf33ffadf414c933848b1754ca0ce856275e68f75b8daf42f6032695272c8f09d057a174d21e99af6d", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sentinelrat", "colour": "#FDBB9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384978, "uuid": "0e3b5407-9cee-4483-a448-701c1486f775", "value": "T1B3C3284033E85618F2FF9FB468B55196473BFA679A32D60E18C8209E1632BC4CD51FB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384978, "uuid": "fd4d6364-72ad-4c82-bdb5-4afabe4f3638", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384978, "uuid": "16ca36e0-f23c-4004-9ddc-0e1211f6302a", "value": "3072:qaeJ7KD6PrqHBUdJ+bBkcO4iTSByOtgcqcHcPcqbWKgYf:zUhrCBUdJ+bNO4hF8E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786384978, "uuid": "9cbd1797-8c32-4caa-a72f-595e0817ef35", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786384978, "uuid": "39c152a5-63f0-4625-8b0b-c463e333f702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384978, "uuid": "46ece5a1-a951-4464-9882-03d994b316b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3c16ab-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786372019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372019, "uuid": "c092fe37-dce3-4f01-9bf1-f45fb12dfd47", "comment": "Malware payload (Vidar)", "value": "c06d8c10bd95ec6b42b1df54d3f9b424", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372019, "uuid": "d02b194b-61a9-45e4-8538-64262441a34c", "comment": "Malware payload (Vidar)", "value": "58b6dc6fba4f5544624ea73c545ff721afd820e035ac0fc8cb9ac0beefe89ee3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372019, "uuid": "3b1006d8-32f5-4759-af5d-5b94358e8cc9", "comment": "Malware payload (Vidar)", "value": "c80b36b2d01014244bdbee4fce840389000dad58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372019, "uuid": "2d23a37d-93f8-4168-8c4a-c6ffd708a811", "comment": "Malware payload (Vidar)", "value": "59142eefb6139ef059e31a733a821be4f70439a511db3c59494e56c7db9369ecd9e49b506e56cb1cd707d37e1213ef64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372019, "uuid": "cd76640c-79f9-4fda-b98d-ae62b62e9689", "value": "T17182A441D11BAAE8C4D6C332A75A46A715F9BC2022315A7F9FECA77A0C52370F3502ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372019, "uuid": "c3a59fd2-f57e-4e31-b1db-de2b2a9963c3", "value": "b6039ed47f96f82fe109de7070ac3ad1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372019, "uuid": "78ec3019-0cdf-4061-92dc-dab70ce7e8eb", "value": "384:BWBd++QpznCipNTHkv+4OwsmJwQqz7oLVhQCEKyKlwr:BNzvpB6ywpw40jWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372019, "uuid": "cbf0b85a-fd83-412b-9c3b-0cc52e43d4e5", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372019, "uuid": "795d023c-4b5a-4664-8351-37994dbeb439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372019, "uuid": "dfd08d27-f731-4fcf-a38e-4c5a03b20363", "value": "58b6dc6fba4f5544624ea73c545ff721afd820e035ac0fc8cb9ac0beefe89ee3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4c8a1d-9460-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786327778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327778, "uuid": "888667b8-11cd-411a-94cd-78664c9ca8a8", "comment": "Malware payload", "value": "1d5ceaba43fa5bb9229fa8dbeb3597c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327778, "uuid": "5f6c0d17-8e0e-4409-a39c-03ec74ba7f86", "comment": "Malware payload", "value": "58f68179c5c95efbe4aa2d3943a7257ae58a580d71ca3a467d01372f9336e678", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327778, "uuid": "43376940-e2c2-4895-b891-aaf012862cb6", "comment": "Malware payload", "value": "72fa4236753f7affd290f98ffba3d936edb41d3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327778, "uuid": "b50d4e93-488c-451a-af93-38a9fc9971b7", "comment": "Malware payload", "value": "eed04d3a97c12d76717e9c497e6dc2fffd097e3e7703cf618bfd176eb89ebd7477a7989cc759625afa44791861fe0fdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327778, "uuid": "48122fa2-7be1-4692-b38f-88360330991d", "value": "T1FC53081BB6E3B0BCC297D0745A5A99F2B9317CA002213E7F97C8FA312E35D112759A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327778, "uuid": "d118c880-a4cc-4d49-85d1-d5e4e716d30d", "value": "1536:5cgDdE1lbUjiSNkvEo5untFqXby0Rr6h6z3Ur:5cHfUjiSCmq+3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327778, "uuid": "510c2d9c-7df0-40ba-95b3-540bf8c47b92", "value": 66640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327778, "uuid": "3941df7d-e7f3-4803-a18c-904501af3b5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327778, "uuid": "d226f065-94e9-42f6-9d9c-adf3eab375e7", "value": "main.x86-64-v4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540ef7e4-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1786371495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371495, "uuid": "1e7c345f-e107-4326-bcad-fb580d91a111", "comment": "Malware payload (DarkTortilla)", "value": "9cacca15cbfc830d6ac0329b09dff09a", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371495, "uuid": "03e8cc8e-27d4-40cc-b557-707e3e365848", "comment": "Malware payload (DarkTortilla)", "value": "5900d609e934ae7f84ec74764d6d108b584f77eed92c55f5e4f2606faeebd864", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371495, "uuid": "ed1dbe15-b3d5-4981-a032-17f63f71f1d1", "comment": "Malware payload (DarkTortilla)", "value": "959561b6d1ebf70c0871df7d64319bdb5c11b40d", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371495, "uuid": "bc5c3f4f-1790-436c-8ad0-1c6ec7ed781c", "comment": "Malware payload (DarkTortilla)", "value": "3d5dc8581b3e034828747bb79dea72b324d07a866fb52b801cc3c6343baae0758c76ef4461975e90743dceae0ed70367", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371495, "uuid": "120581a4-c45c-4670-a98a-3fdb8b0e5d79", "value": "T1F935F1298DD76624DB7D4F78C0A648AC23F0CA9392A6E71F3EE910F48F527D5A917043", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371495, "uuid": "90c05e49-7b1a-47ab-837f-166e33515782", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371495, "uuid": "2af629a9-d9bd-49a3-a911-1142ed2f95ab", "value": "12288:7jKpPT2CPpHAP/iGc1ZOM+FhWF2hekxpp4y/ZeGRpQ6s7Ewxz4RH69Vs:sb2UxAPqGcv/+Duyx4DiKnzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371495, "uuid": "257f8bac-a212-468d-8422-4737c6b8c0e8", "value": 1109504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371495, "uuid": "6079f6bb-a210-424e-a52f-cba451788d0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371495, "uuid": "696bec9f-0543-400a-aca6-9d38cd870ce1", "value": "5900d609e934ae7f84ec74764d6d108b584f77eed92c55f5e4f2606faeebd864", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5b0991-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786373580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373580, "uuid": "8981cb97-ef8b-4492-b419-f6e3db8fc9df", "comment": "Malware payload (AsyncRAT)", "value": "2a1f45a5a55a001e68b8559eb54a7b26", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373580, "uuid": "e04749d3-39e4-4e44-8882-593abca85652", "comment": "Malware payload (AsyncRAT)", "value": "594192542dd1221ccb2f04f72d23c6e8422cfa87e7d41aaa10f1e16f1aba1035", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373580, "uuid": "4f5ccbc4-6d26-41d2-99d1-70a30e90720b", "comment": "Malware payload (AsyncRAT)", "value": "cbd45b80a084d29ee8da3692a6d5d342381cdcff", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373580, "uuid": "17eefcdb-a21c-4a07-aad4-466cf7791cc9", "comment": "Malware payload (AsyncRAT)", "value": "f3136bf052f340debc12013356649457deef61f142576270ac2344bd9c2be7666f81aea81542a954c892abb1f5a5e7ea", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373580, "uuid": "eefff1bf-eede-44f2-99c3-1a6dfbbb2403", "value": "T12C15E06826678602E4B66FB00DB2E0B0577AADEAE532C2194FD63CEB75777107C05327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373580, "uuid": "725b2bd1-9d58-41e3-8ca9-4f85fe15f395", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373580, "uuid": "248e7152-b8ce-4674-ac0a-c1e45a9d99d2", "value": "24576:gdEaWSn9mZE3xw5xGLIcUJRvgUFcYYUODMKeZ:gdEaWCeE37dax3Oze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373580, "uuid": "8d55c0c7-12c0-492e-9b4c-e3212b880359", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373580, "uuid": "158bdbe3-0e5a-4bae-8275-bbde37d72a1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373580, "uuid": "6bc54bf0-c557-4f09-9dd5-7b93b8be8367", "value": "594192542dd1221ccb2f04f72d23c6e8422cfa87e7d41aaa10f1e16f1aba1035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a77464a-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786371963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371963, "uuid": "38cd517c-ac39-4a50-bb62-fabbff545830", "comment": "Malware payload", "value": "f783893045ef51e0141c70ae5aa199fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371963, "uuid": "c07614b3-e90b-41ca-833c-6273fbab1190", "comment": "Malware payload", "value": "594c42bacfe1f7159873262077f51ceed16be4b15c78ea981357d6cb959ccb0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371963, "uuid": "657ae170-b14b-4e03-b0af-b935ac417397", "comment": "Malware payload", "value": "a257f35a4eb80478db7b487a9fdbbf3ed67c99b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371963, "uuid": "ef0584ac-7c85-4846-b63e-0d419a552eeb", "comment": "Malware payload", "value": "a2f63a0ea7ab00114d2170e664fc1a5860907f6167ffe3468a36f4b770736d0f48e9686a173c20ddbf55b08318943d79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371963, "uuid": "14136fb3-ba35-468d-97ed-fa0a15d2dd9d", "value": "T12045E1987142F5DFC807C6728EA4ED7465542DBA5607C203A0DB3EEFBA3E5879E140E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371963, "uuid": "ada15c70-1016-4202-8ff8-3711782e7979", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371963, "uuid": "4665c43f-c234-484c-b364-f900f24229e9", "value": "24576:D49oHZw+NkC9o4Q+6QwjPJ3YaGjCdZ9Qve:89Qy+ZTr6XjBIHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371963, "uuid": "dcf8ae61-3d14-4c59-8ef0-3b4faa8f2dbe", "value": 1183744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371963, "uuid": "c0e71fd6-50b4-4b72-b7d2-382164a529ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371963, "uuid": "283ad462-e069-4ed3-ab15-adfe6d4d3426", "value": "594c42bacfe1f7159873262077f51ceed16be4b15c78ea981357d6cb959ccb0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4efd5255-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786373205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373205, "uuid": "78b33fa9-40e6-4c5a-91a6-1b68f3cce80e", "comment": "Malware payload (njrat)", "value": "4a1c4b526ea937d4f7dd7b892c3183b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373205, "uuid": "b4e4c5d6-1c03-48c5-88ad-5c1f5c29cf97", "comment": "Malware payload (njrat)", "value": "59afb3104b14bf45f5b8672c31ae96725427395fd0f7eb842a0eb41026480c6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373205, "uuid": "65138241-37df-4606-b28f-84e0722f641f", "comment": "Malware payload (njrat)", "value": "e97e2de910c26da660dfdcfa9c96bc0815405203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373205, "uuid": "3b872b3d-369f-4471-bd06-24c682d7dac1", "comment": "Malware payload (njrat)", "value": "02a4d49da55401276ab80d3f631eaaf8fbcbd9e6d359dd9a5d67dab0772683ee98fb837986d4835748177f9755b56063", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373205, "uuid": "12600950-f74b-4206-9f08-cabfd8baed6c", "value": "T17715F0442346E952E0DA87F2B9B0E37433654CCFB9D2D2D66FE92FF738187815958282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373205, "uuid": "6b0ae1b2-4203-4b66-8536-fe120ecfcca5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373205, "uuid": "0b6734d8-4163-49e9-9878-71d7a44c99f7", "value": "12288:zrxxltnn0gGCrzUq/nqBpovZp6Eg8nsHG/KNu1aZxMKEwZPU4+5lVhw1XPJdo2:vp50i/UqYpoRzUH7u1aMKEwPinhwZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373205, "uuid": "35193aea-f5e5-429f-86c8-6df4643474cb", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373205, "uuid": "165d25f0-e77e-4c61-8159-8cd429e87366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373205, "uuid": "34d94707-7b79-4007-8b42-882c1a7fe173", "value": "59afb3104b14bf45f5b8672c31ae96725427395fd0f7eb842a0eb41026480c6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0c7480-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368177, "uuid": "30a75b09-b2d4-4073-a97d-492d12296aff", "comment": "Malware payload (Vidar)", "value": "d50e022b61d0de214cd8bec4fb2196ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368177, "uuid": "a2c8cc48-79f7-4b5f-ba34-8cbad1a73094", "comment": "Malware payload (Vidar)", "value": "59d248d3cf52b5947f75aaacd646edd910b0c06a937a80788fbe4ea7f5dbfc17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368177, "uuid": "81108219-c073-40b7-bdfd-9190b4f69fc3", "comment": "Malware payload (Vidar)", "value": "011b56d9a080ce9312bf8c41b69afdb5d603d9c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368177, "uuid": "7c4accca-6e30-402f-bda3-46fc1e78f67c", "comment": "Malware payload (Vidar)", "value": "d14166c148763aa7afe4f8721647f23c1ae1940574002a862aff54f27542b741966d33463d85da58366e243865e04a69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368177, "uuid": "53dfdc5e-ac7b-4c1d-9a1a-151354d5f661", "value": "T187522B82F4D2C1F4C0BFD3389BB746A7AA76384012736DBF778D81A01E9262169783D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368177, "uuid": "e51f5f5b-4e48-4533-a27b-990d0a5a4693", "value": "b94dba3155137e594dceb5b549504f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368177, "uuid": "f8e52555-04c7-4582-95c9-9b21f49263fc", "value": "192:iY7KK7dOj/l2dRH40GSXtW+qxyHThRIiGZ0trTzV+YyIVKOr8KbZ/Ai3Vii:NYATHtYWzqqtrTzVryIVKwBbZBli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368177, "uuid": "c72142c1-6f97-43ae-8a5a-7f6e7d87aabc", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368177, "uuid": "df432805-3441-49ac-b0ef-ac65a63a8eb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368177, "uuid": "d24a1ce1-5ae4-48bd-a4b1-19f511d53271", "value": "59d248d3cf52b5947f75aaacd646edd910b0c06a937a80788fbe4ea7f5dbfc17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8bd59e-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786374145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374145, "uuid": "fa2892fc-2ed0-4f1f-abc8-d995198d9391", "comment": "Malware payload (AsyncRAT)", "value": "829393f19df1e8ff2770ecd3dcb0e417", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374145, "uuid": "c4313818-802d-42be-8687-46d1b3f97ca8", "comment": "Malware payload (AsyncRAT)", "value": "59e6303685243d077aab158429f8f407bb9b2cce3c3eb4fbaef5335afb5e61b4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374145, "uuid": "0b9b8858-5f67-435f-a9ed-e38eb5053979", "comment": "Malware payload (AsyncRAT)", "value": "b942992ff727373b8f72da13b81f44d2e8cce40b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374145, "uuid": "2a53d42e-ec60-4ab2-b847-e77ff0281309", "comment": "Malware payload (AsyncRAT)", "value": "a600511eaecd8f47558f3c43255d68c04d149a3bffa30f7fd085285ef3362e46a48cf25c9ff0284c137af232d291cddf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374145, "uuid": "7df73cf1-dcf2-4a02-819e-be7420174745", "value": "T1E90501586206D616D56483B80B72E3F8077D1EDAA810E30B9FD9BEEBB639F548D04353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374145, "uuid": "69a91e36-352b-47b1-a741-ee7a305a93bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374145, "uuid": "8b9fec41-403b-4330-a8a4-f8352fd90ec0", "value": "24576:deA9szFQgynqlXp4Tv1j/pLJ1eoieX52mv7qvY:UUszsnMCTtFio12mv7qA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374145, "uuid": "6e0cd1e5-ae69-4565-8bc5-3098377a4e39", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374145, "uuid": "4159ad94-2c29-4dcc-b225-0fec7e39c0fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374145, "uuid": "38dfdc71-0277-40b7-a218-63b250ec28d1", "value": "59e6303685243d077aab158429f8f407bb9b2cce3c3eb4fbaef5335afb5e61b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e992e96-94df-11f1-bd95-42010a9c0009", "comment": "Malware payload (HijackLoader)", "timestamp": 1786382197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786382197, "uuid": "1684162d-0790-49a4-9f5d-4b85ef7701ae", "comment": "Malware payload (HijackLoader)", "value": "11004be6526584606e56c4c9e0f61d6e", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786382197, "uuid": "086aa985-dc7e-408f-8bf1-cf30d3d08504", "comment": "Malware payload (HijackLoader)", "value": "59f39368894fb8e19301c62cd8346edd31085939c6d0e83a9b104a7fa8c0c56d", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786382197, "uuid": "8301f3f2-7be2-4405-bd56-5f87ed44b1a3", "comment": "Malware payload (HijackLoader)", "value": "c843f8fab805052e5902cedf31567345bdab2edd", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786382197, "uuid": "2d1874ea-bfbd-41a2-aae9-7e95081bd311", "comment": "Malware payload (HijackLoader)", "value": "69ac6b97590b5ee87c38462550251be9dbc11e02e8b7b3a185b45ba01c650fe0e4d16a59fbf5eccea633197f10bbee28", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786382197, "uuid": "de6d6a7a-f690-4fb6-b7c2-c32d930041dc", "value": "T1C1A6334043D31176F5A62D395806D5008E1239FC50EF315B6FFACAAE2B71B91D83ABB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786382197, "uuid": "4f6d8b7b-fdb3-4d99-912e-fb1f251ff921", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786382197, "uuid": "7234d3b6-3acc-449c-833f-27218fb71f5d", "value": "196608:QM1gY4874wbUpZP8+xyETR+CPsNmChn93IVpdHCYdv3wtdkBqLxj:QM1gT8Ewbe7/dWmC19AEyIcBq9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786382197, "uuid": "2f613d7c-5e37-4fe2-af7b-894f74d16f82", "value": 9947489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786382197, "uuid": "1c97d595-3c17-42c9-b288-8f3db294d39f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786382197, "uuid": "d352f1aa-fe20-423f-a46a-7654d4d10a9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7daa9d8e-948e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786347513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347513, "uuid": "c96dcefe-5b17-4e43-98fb-c7593b453a7e", "comment": "Malware payload", "value": "253657209d6d2c33d059ce4d6038eda6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347513, "uuid": "3e203b0a-2e7d-4980-8a47-79d8d67fec66", "comment": "Malware payload", "value": "59f5ebb14c5c0eadefaf4fa26448216e9f6bc8f746724b2eb395192befd5cf1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347513, "uuid": "ad4fb79e-6cc8-401e-b761-0cad255e3885", "comment": "Malware payload", "value": "db3bb14b89267653a9045705bf853a601f95c410", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347513, "uuid": "4748c8c0-c50d-4814-ba35-0e93877a5de8", "comment": "Malware payload", "value": "6afed43ad2399dcbf27814cdb4be71ba5ff894efd9123e3ef505419b9838a81b93660de7a77fa70dab391024a17420c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347513, "uuid": "126c9a33-e930-4486-a1b6-d17c3a697087", "value": "T106333B8791B4D5EAC570AB37E557FBF6829BBDF484D84B1D0C88EB2B58B0B004724D22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347513, "uuid": "62d46032-81ac-41c0-b874-725af4d4f776", "value": "1536:kYOAzZlOX6ZpveeDkyRpfKcSA8WIZc73PQRyVj:k/olOqyeRpSA8WIZ0Xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347513, "uuid": "4850ae9e-dc5e-46c4-a238-201b2234fc1e", "value": 50232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347513, "uuid": "47e3d0a3-c808-4a43-88ca-5dc73cbd1f11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347513, "uuid": "df1fd364-fc4e-427b-86d4-66bccd0b9be5", "value": "main.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829e055e-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383600, "uuid": "14a07ce6-9b37-4f91-a2f9-80a3980542fc", "comment": "Malware payload (Mirai)", "value": "8c51a95aba02640130cbdbb5d5603eda", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383600, "uuid": "d791b55a-235a-424b-a866-0c56edffe679", "comment": "Malware payload (Mirai)", "value": "5a0185e4dc07ba2f6c94b43d83289e7de2b2ff7a2207247298fbc0b72cc1fa3b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383600, "uuid": "8b5d4579-fe23-46d3-94e9-d9d97fb61506", "comment": "Malware payload (Mirai)", "value": "9a58b442f8733c01699d5c90fde27f772f21a411", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383600, "uuid": "61fae6ef-6932-4d4d-be6f-47a4b165791e", "comment": "Malware payload (Mirai)", "value": "a66e679ba23b66c1d1b4d27e272f0269fd9d35be98f2cd9b73c0ef6249f6110737b4791f053e2acae11ab0680b8d46b1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383600, "uuid": "0142e44e-739f-42fe-bc2e-45cf4dc8259b", "value": "T1B5B3120DAAE0A693C717E93D111D6331E00A5B8035C27FEB07A8D886BF30D559F6F964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383600, "uuid": "2e24e4f8-4392-43cd-8bd7-79672e391359", "value": "3072:EE2Xt171cbCXNqmC0kEecHnk6bO5dWg+jVIrZEETw:EEgtpNqp0kEvH9bDfgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383600, "uuid": "6b01fcfc-5ec5-418e-b00d-cc7c46214c40", "value": 107568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383600, "uuid": "8ddc409a-d9b6-4cfb-bbb1-d8b9d1db7d12", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383600, "uuid": "0bb19a3f-5cbc-407f-9842-64553f16de66", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745eb073-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340196, "uuid": "6827cd82-a029-441b-94a0-983b793028e6", "comment": "Malware payload (Mirai)", "value": "ab1b68a364221fbd7860a409fe2ea7ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340196, "uuid": "84499071-0941-4942-b7b1-54795d064690", "comment": "Malware payload (Mirai)", "value": "5a6017f3f905b8aca076fe8cdc10b4567cefe960d200e30f97dced8a9761180a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340196, "uuid": "8a450216-ca7f-427a-81ed-6f54ad0db493", "comment": "Malware payload (Mirai)", "value": "e451957c38b377f35b73dc987cb56c079d96323e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340196, "uuid": "f36543c3-0e1a-43e2-8907-ebb6da0df3e1", "comment": "Malware payload (Mirai)", "value": "b0d6436fdc2d94a4c9491827bc45f263c14c0dbcc0381ab7cae32faae0983b6006dc80d76dcbad022f079d5046b3fadc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340196, "uuid": "44496660-0e16-4f9f-932d-f822d84eeda9", "value": "T17A846C8842F5E6DEE2C8F47953053C166872393A3493F296350FA6BB53A62540AFDF31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340196, "uuid": "2d31e529-d5c6-43e5-a35f-989ed0e38ff9", "value": "6144:v2sa9p1decla9dN55zIdybZKQF6Ufv1Drdp3UKck:v2sa9p1+dzP9F64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340196, "uuid": "cd671c64-f75c-445f-b10b-eb2d082a554b", "value": 396304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340196, "uuid": "1d2c2c06-041b-4ec8-b8f5-a19b3edc9be9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340196, "uuid": "4f7b6586-f2aa-4261-88ed-26afed904698", "value": "vlxx.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7522dfe3-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "39aaab7b-a980-466b-b4a9-f7e6647d4fdf", "comment": "Malware payload (Mirai)", "value": "6d01cd8007ad4b23ee7470d9e0928834", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "b01e0d3b-6fff-4478-9d13-d2fb2b5f0fad", "comment": "Malware payload (Mirai)", "value": "5a73ac1265512d75eb2a65a941e062f680b3581c295ab13403d097f8cc3f40af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "af1d21e1-4756-4229-978b-6c7cadf2a31e", "comment": "Malware payload (Mirai)", "value": "06cc11260439c02b391fb3676ddea396011896bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356948, "uuid": "75cf0044-d61e-4ee0-b72f-605296e6be07", "comment": "Malware payload (Mirai)", "value": "fc8f1f1d4dfc03e54876947ff2f85c47b04722d1ea485a62d98830bd13a545c01093758e28ec8375bdc7149c9fc5e7b9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356948, "uuid": "fdcc5ee7-32e4-4eb0-8b72-81325e538bf0", "value": "T14BF36D80F313E2F6D84704B0617BEB339A359556511BEEC2D374DF35EC62912CA1AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356948, "uuid": "5a2e4544-47be-4bca-8935-6c97326c3cea", "value": "3072:JLIxaXdi+w3/tQeFghXxBaX593ReY2aSrIvwPzQIC+:JLIxaXM+2/TFgdkRB2+wPzHC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356948, "uuid": "49a758c6-1775-49de-819d-754cca7c26a1", "value": 159360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356948, "uuid": "1e51c6f3-7d1b-40d4-9606-818f9328a979", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356948, "uuid": "ac843546-ecb3-4fae-bb34-edc475decb00", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4b607b-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786372747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372747, "uuid": "8e148a24-2f00-4d5d-86d0-a60e00e3359a", "comment": "Malware payload (AsyncRAT)", "value": "00e069645fa04c1fb6c54d02f1eaecf3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372747, "uuid": "e6afdf14-b11d-4902-83ff-f3e58d416f31", "comment": "Malware payload (AsyncRAT)", "value": "5a83f8a2973445c7e801d8b470851a4fa6dfc51c776f8233c727c7fab9281fee", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372747, "uuid": "c85709bd-5376-41be-a3ae-68eeb724e8f2", "comment": "Malware payload (AsyncRAT)", "value": "d68cde7896228b50914e405de3e82cc1436393d4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372747, "uuid": "effd1fcb-87c5-4255-b4ce-655789e56248", "comment": "Malware payload (AsyncRAT)", "value": "31e338594db631911ebdf7335b6168fd5856365960e46e0566bc8ac8a67ae662d0cd36373f64e15bd3855ad4c477f938", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372747, "uuid": "020f9448-fa78-452e-93ac-1e7f13e785a6", "value": "T1A405F155121BD842D0D687B6F8B0C33433645ECFB9D3C2966FEA2FB7B91A7C25980681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372747, "uuid": "47e6dbd6-e1ba-44eb-84df-e8f272fdfb28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372747, "uuid": "8d883328-a088-4a97-b01f-e2eefe9b7ad0", "value": "12288:cq6xxltnn0gottMSu+X5l+ldszJmJKtLW8NA5cQh0GfKNZwVpOV5B8e8:d6p503tMZU5lsKzDt1NAGQh0GAo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372747, "uuid": "fb09538d-5027-4119-9765-3d5faa5781fa", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372747, "uuid": "8512184e-97d2-4255-b90e-e85a04e8ee66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372747, "uuid": "8641c789-6638-42d8-9f11-c4a7f7db2062", "value": "5a83f8a2973445c7e801d8b470851a4fa6dfc51c776f8233c727c7fab9281fee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c63f821-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786368449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368449, "uuid": "34dfcf3b-45d3-44b9-b15e-ca44a3f98c8d", "comment": "Malware payload (njrat)", "value": "663da4a53a92bbf3688ef7d91bf3fc4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368449, "uuid": "927197b7-64fb-48c6-8f5a-79bc20f4ad84", "comment": "Malware payload (njrat)", "value": "5a8dbab4f2464d521ce35d20bc1d2d45a72476e364fe2a5a79b0a6e4ea0db33d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368449, "uuid": "8d994c41-6456-431d-8e3f-2adb8abb5f08", "comment": "Malware payload (njrat)", "value": "46c9090f45a74b0e2fd54ab0b70b2250f9bd1271", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368449, "uuid": "ea97bab6-b7d4-4300-9adb-b176214f02d2", "comment": "Malware payload (njrat)", "value": "6d5fe456b07f2a151cbb67fc629604ddb71127f29f797e4a91759d39f58fe2a7b180dff7579a3a1f3967e0ff5310a1ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368449, "uuid": "f892c172-48df-4aa7-b391-3080c72bfc5b", "value": "T11205E0D03739BB05DEB41A319974EEB583B92DA9B420F9D61ED93B9B346D2005E0CF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368449, "uuid": "2a83f2d9-2489-4270-a428-64dd1bd2eac1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368449, "uuid": "a6cfe4e5-46d6-4c27-bda5-b604ae5a797b", "value": "12288:L/PNKL9lQWENV39tdbMlqJ05w8evudkglK6hFhR9KbHiZagI6nFP0h:RHdDdjCwSdkR6hZAK5I61q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368449, "uuid": "7f88b133-c17f-4c63-b581-225135232d90", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368449, "uuid": "8ed26bc3-3bfc-4e6c-8ec8-57d8324046b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368449, "uuid": "6cd599e2-0a4d-4748-be8a-fd37f2f6009f", "value": "5a8dbab4f2464d521ce35d20bc1d2d45a72476e364fe2a5a79b0a6e4ea0db33d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d19d156-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371001, "uuid": "3ceb2ba5-4b76-4c24-82bc-c40dd3075ad9", "comment": "Malware payload (Vidar)", "value": "2cd298d36fb6f5bebdfef8501b9b47a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371001, "uuid": "3f496ab9-cadc-4d80-962f-50bf03d83719", "comment": "Malware payload (Vidar)", "value": "5a9dd3ade3194c8459a3b03dc0280ac98e10fb8400682c99e5707f9db9148c9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371001, "uuid": "12d9cdc8-ffad-49e8-b411-785ef2f09dbc", "comment": "Malware payload (Vidar)", "value": "da2bce712ca46c7a704c3c390c5299dfe87997b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371001, "uuid": "c86d87e4-99ff-4b71-b2eb-0c703bc46199", "comment": "Malware payload (Vidar)", "value": "3b2a28c5b98ecb219a91046c7c6d29fbd5552e308a5851056514912b935ef3b53de83c4cbfd3312dfaa088760bdb66de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371001, "uuid": "0eba3a47-2d4f-440a-be8e-01d22111e86c", "value": "T10B52F8CEB28BB1B8D32E857DD707227BC71230990A195FFF1AFDD990368251079B1A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371001, "uuid": "6a84f2eb-049e-4e55-95af-add5f1e48758", "value": "bb652ddbfc6d78f25974f95364fa638c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371001, "uuid": "cc4531b8-dd27-4897-a074-f82862d84f93", "value": "192:WfB8GX93owObc89N3okwDNCPpTQaPyYsBZ1tx2AFMG+ER2Te3VfA:WqGXQbc0YbNCPpTK9BzFvFl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371001, "uuid": "8399ee24-d412-4ae1-9cb8-f751702b0271", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371001, "uuid": "b2ea601b-4414-496d-a5df-918fb2cc4b49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371001, "uuid": "f46541c7-3114-4de3-8851-c51577970dd5", "value": "5a9dd3ade3194c8459a3b03dc0280ac98e10fb8400682c99e5707f9db9148c9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65a210f-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369513, "uuid": "3da1b4c9-8e1f-4deb-8df9-f935d48f36d7", "comment": "Malware payload (Vidar)", "value": "42cf1045a0552dd34f3753140900232a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369513, "uuid": "d87743bd-c732-49fc-891f-1c444ed280ac", "comment": "Malware payload (Vidar)", "value": "5b480ce175fc479dd01496b9a47a166a599a8f26a6406dce8a036ede8cec8608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369513, "uuid": "f4ce1211-60b7-4cf1-9289-293d4525b0ed", "comment": "Malware payload (Vidar)", "value": "510a03fc5a1b8abe740bdcb5d2ed3b5e5654addc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369513, "uuid": "ce24f87a-f8e4-4858-837d-8d6bb9d54fca", "comment": "Malware payload (Vidar)", "value": "a309e23cc0549162453e3339644b0bd91e97fd74555563000b1c3114afe1c60c752473af5350ea66743edf0f9c6c5fa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369513, "uuid": "1fdec94e-1dee-4913-bf7a-83d6146365d7", "value": "T12762F98A71D361B9D1A9C27CEB5A627BD766309E071A1FFF69EC874423824013AF4760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369513, "uuid": "cd284fe3-8c52-4da7-873f-b96c10df8a5e", "value": "44c0a950cab1227af44f555aa5a62d98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369513, "uuid": "e6218aa6-e056-4d2a-be58-b1b0960f09f9", "value": "384:O04oK3mBYtqzojPNQg0CeQyLpbu6oLAlNR:ocGqCNQSeQ4k56N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369513, "uuid": "0739ffc4-fbe3-4798-bb4e-9d77a347323b", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369513, "uuid": "d7797b7e-d231-468c-ba43-2829dc62dc96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369513, "uuid": "69d4b042-116c-47d2-9daa-4f4b365f3ffb", "value": "5b480ce175fc479dd01496b9a47a166a599a8f26a6406dce8a036ede8cec8608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ab0aa7-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786355630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355630, "uuid": "b29a8dc4-ccd0-4d47-bff8-b575a19626b1", "comment": "Malware payload", "value": "8d62f8e9816ba795639e43d398cab820", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355630, "uuid": "5d8bdfbb-7820-4e7f-aaed-f97bddacd03d", "comment": "Malware payload", "value": "5b498739ac5dc16b2106c966ac3ca89942a7a5d2b69f9c56cf392aabaf9498a6", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355630, "uuid": "5e7772d2-b061-448a-bd52-c1b7ec6cf489", "comment": "Malware payload", "value": "967aba10ebb5a745ae7a8ef6660e9b7bb49fce72", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355630, "uuid": "ad72275b-8915-4c9c-bc2a-9665daa02e4b", "comment": "Malware payload", "value": "54567ce7d3774c673b032b8ac9d0bddc4b3dd6be54632614e98c0668bb30bfbaf7904aa7575b3db7f5144f309788b9df", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355630, "uuid": "b0ffd4cb-9154-4cf4-a3b7-3cee380c204e", "value": "T1D4E4BF05B3D1D956C75787394DFAC6442A76BC124E52870B3A8D7F2FBFF26804E81A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355630, "uuid": "a0a840b0-1b2e-405c-ac22-cfac526f3465", "value": "12288:6KpUdmZHcrlQkLZpVPKj/tGeAYiL/7ZLW0Vvizd:6Kf9cRlKj8eAY+7ZHvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355630, "uuid": "c88bc422-95ab-4d95-ba6b-e490101655a1", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355630, "uuid": "614b9a78-9f2c-4d93-b42d-129454ee3442", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355630, "uuid": "b6b1b21c-d249-45ee-ac5e-fb7c237f0af5", "value": "09-08-26 weekly BDO ATM Payroll Converter for BOB - V3.0 - 2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d17615d-9464-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786329474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329474, "uuid": "b872ed98-175b-4d68-a7de-209b877ca0b0", "comment": "Malware payload", "value": "be5c401d86413cfa764c91489405402b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329474, "uuid": "9a645a31-cea8-4bb1-adf6-68396d769b03", "comment": "Malware payload", "value": "5b54849bed4c6a637854032d9d8b941548d819ed7243813723ddbe3156edc74f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329474, "uuid": "3f9d1172-2b33-4aa7-b76f-20eab8452419", "comment": "Malware payload", "value": "ef1050bc498fcf0a6e1fa5f6838afaf54de7c101", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329474, "uuid": "7701969f-caa0-418b-8a18-a0d1c980e328", "comment": "Malware payload", "value": "869d8121d4e1a0e37bd7187cc15b79a730eefd1dbff4bb2566c3b0e5f9b60a08bee242b1338fd4780a06770a88327563", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329474, "uuid": "64f9289b-5657-4228-9c3c-0c062c4938a9", "value": "T1F325BE533BF61465D7404A358FE2D320B24ADBA934D54A4B9F508EAFDF032651E82CFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329474, "uuid": "d0c2fa51-aed6-43f9-8d05-fd85c9ef1327", "value": "12288:NighdbJ5uMWro2BEXkXCFTrdnW5nAyda5g6eSJ:th9bLUsFW5Fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786329474, "uuid": "d99afdaf-736d-4ce5-ada6-843dca516662", "value": 1057088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786329474, "uuid": "84bb448c-6b39-4338-b8fe-c4265e37457f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329474, "uuid": "dcaaea71-aaa0-441c-8f71-31a1c285df7a", "value": "main.sparc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d03de3-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371257, "uuid": "4f8b3f69-cccd-4afa-b4ef-a2a01bd58ab3", "comment": "Malware payload (Formbook)", "value": "b67879e61b809814aa86b3ae612b3c9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371257, "uuid": "6686f78b-14d5-485d-99b3-d77ebd86d848", "comment": "Malware payload (Formbook)", "value": "5ba7f09d6a20a5c462a5852db6fd3ee719a35952752c654178c2beb564062fd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371257, "uuid": "0d5a9bf6-45c4-4ac8-8b4e-a662e3f53854", "comment": "Malware payload (Formbook)", "value": "10a054bff831e107a764c248c623c3d52f1fc096", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371257, "uuid": "98b3d936-f067-4a84-9724-3fe0a55af20d", "comment": "Malware payload (Formbook)", "value": "70803d2e1a0fc221d4e2ff483778c709503e132a01b1eb66797f240395efc08879793758d7881ac1d102614e524467dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371257, "uuid": "2f148865-8d9c-4c4a-805f-d01be8e4700f", "value": "T1424512606614E716C51867380AB0F3BA63F86EED7900D346DFDDBDAF7932B014928693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371257, "uuid": "d937f5f9-674b-40ef-a2f2-e58bb5d666d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371257, "uuid": "4b7078aa-2bf1-4fc3-87aa-5ceaff6dfbdf", "value": "24576:pV/+ULCX9PIHg31HPy23N4zJimkoueiTPX169D:9Lub31HjmzJimlueR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371257, "uuid": "71accda1-ee68-4381-bc8d-3dc314af4037", "value": 1207808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371257, "uuid": "04d99666-3e6e-46c4-a8ce-dec01401f1f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371257, "uuid": "636b6d97-fec9-43a5-bf7f-437eb3e87bb9", "value": "5ba7f09d6a20a5c462a5852db6fd3ee719a35952752c654178c2beb564062fd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415f7582-950d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786401958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786401958, "uuid": "24abe338-aa9c-4ce8-a4ca-9631be1cf614", "comment": "Malware payload", "value": "7d9888e5aaca0d7af493997815700f61", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786401958, "uuid": "f3fe6867-7268-4be9-99d4-34df3986c0c6", "comment": "Malware payload", "value": "5bb16c59b51e8d7b5ecccd686d7b75a0a1ebc5539609f489de6064c47c1cfc7a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786401958, "uuid": "532894d8-70fd-421d-b61e-0156dc031c33", "comment": "Malware payload", "value": "cf19d5ebf09377432f3cc38ad94f8c7e0c5222d3", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786401958, "uuid": "4c8b9713-9eb4-42b2-adc9-2778f7fdb0a8", "comment": "Malware payload", "value": "65414764541d273339251edc0223e69a572b7a67984cd98bdd0c74e1e54f2d413c29388fbfb2c66c9c0e4a5bb720978d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786401958, "uuid": "de5d63f6-6f65-41b4-9fbd-126175128c5b", "value": "T1F142F99CEED172B0F31303CE77AB2929122461D72008C5C5F98C9DE57F467D88666A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786401958, "uuid": "bebb4c84-b3e0-44e5-beda-f5a88b4b6c1b", "value": "192:sGHNsGeTHQpD+da6+888+UV7tDoj/pxzaW5JYb55qr5HdUIz4CthO5Hk:sGX+/DV7k/3aW5WfqjUg4CTO5Hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786401958, "uuid": "31df1d93-427c-45cb-ac4d-c5404d900dcb", "value": 12227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786401958, "uuid": "8a9bc485-91a3-4c8c-988e-5ae61a14e019", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786401958, "uuid": "f8055c92-0e86-4582-b78e-78163716588e", "value": "fuck_niggers_8.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834f6ad3-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786374152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374152, "uuid": "0f635a5e-ae3b-4133-bffb-c6c2b8538e8a", "comment": "Malware payload (PhantomStealer)", "value": "f0dbc760a3aaa11bf81363c6af0cc884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374152, "uuid": "b31e3b11-f547-4a4f-ae76-f5157fff19a3", "comment": "Malware payload (PhantomStealer)", "value": "5bddfd79c9fce9b9a38f93cb83eecc1571de4bfc78e0dd276945e4e40417a5f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374152, "uuid": "810d382d-4a91-4ec8-bac7-3690e7009498", "comment": "Malware payload (PhantomStealer)", "value": "18026fa711df2b9198606ff68f481a5c0d353641", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374152, "uuid": "4edd8e5a-2cb1-44ae-ba3a-a6e1920c0052", "comment": "Malware payload (PhantomStealer)", "value": "e8afc8335995644bff4789444c23c10717d321f3c53b8679da5c6b9febf92829cbb6684814ba23c5a17c2d95a13719c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374152, "uuid": "8db54752-90aa-4ad2-87bd-b62bf7f6e7b2", "value": "T1D37512882612EE06D58553B80BB1F2F48B394DEEE410E3175FEAADFBB539B244D04653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374152, "uuid": "dfb03e60-d617-4dc1-8642-3ec4fd5eaa45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374152, "uuid": "7977fc12-286b-4f62-9ed9-47b821235b4d", "value": "49152:sUscL3jAR4lytVPD83KLeIcwZUp33R1wH4G:sPTRgo783K3ZUp33R184G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374152, "uuid": "487d852b-0620-45fa-820d-46aa88ad466f", "value": 1580032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374152, "uuid": "81568868-b5d8-4244-b872-afec4e10bed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374152, "uuid": "216c376f-8d2a-4434-9e6a-e16b114d95a3", "value": "5bddfd79c9fce9b9a38f93cb83eecc1571de4bfc78e0dd276945e4e40417a5f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e1dfa1-9513-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786404630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404630, "uuid": "05ae1a21-1a51-423c-abdc-d6abef4650d1", "comment": "Malware payload (Mirai)", "value": "2a0ff6df487d9fc92766be98bd310d13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404630, "uuid": "9f0f220d-b166-4bb8-879d-529a3c567d1f", "comment": "Malware payload (Mirai)", "value": "5c2344f30999cb0ada70828adfcdb7efc1d757f76a7f912fe6f1ab9ab3b743dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404630, "uuid": "3a97d308-6ce3-4532-9f4f-948411318051", "comment": "Malware payload (Mirai)", "value": "8ec4f3f1ed17f88f6cb00e1dee415135eb3849dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404630, "uuid": "d5f8296d-d5e8-4cf8-ad76-353bbc55a9e5", "comment": "Malware payload (Mirai)", "value": "d3cef950c8fb7de9828b41bd8543f6a7f13c9293ccc73935d81bbcaa9db70a722f99fa45ededdafa389c5f9b00c70e80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404630, "uuid": "085fd7ec-86f4-4c4b-98b3-f50104ce36a7", "value": "T113530A89AEA11BDBC46FCE70453E031726EE485F62E27336457CDC5476EE2088AE3D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404630, "uuid": "baf3593b-55cc-4730-80dc-ca9e8bf5239d", "value": "1536:ruAGSjhql8FY48NzK3P59sVN1mjWrN6+DQ4pLjfR3:ruAGahql8FY48NzK3PsVN1jo+Dr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786404630, "uuid": "cd20f8dc-503f-4bbe-8b8d-bbd30a9a855e", "value": 64876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786404630, "uuid": "4db22b2c-af2c-4654-9678-dd1d4df9d28a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404630, "uuid": "7688a0a9-e8ea-4f60-91cd-249130048cdb", "value": "mini.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c33cbc8-9460-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786327781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327781, "uuid": "8587b164-06b8-4ad9-ad86-0c8c8a97d284", "comment": "Malware payload (Prometei)", "value": "a19d933d23e188f44f87e6cfbc79754b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327781, "uuid": "43806471-5a92-4e27-9ac8-1c0c66540a37", "comment": "Malware payload (Prometei)", "value": "5c5575b228ce5c6f5cbe7dcdcde823a6ca926665f345adc585c8cd6df4f89ac0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327781, "uuid": "9c33e0d2-cac4-4464-9d69-7a03333ce62d", "comment": "Malware payload (Prometei)", "value": "22469e8745c819600b8d0fcdc88b3d9fc22c2528", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327781, "uuid": "782d6618-68b6-467d-9bb8-358124f5325b", "comment": "Malware payload (Prometei)", "value": "99676e0f19d660b4f6b184a016dc84885a25cfe326298c9284719a2b2500ee864cf11ab2db6b83a764ef675e9937a5d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327781, "uuid": "da10d8a2-ac9e-44de-be9c-2d0da9e603b6", "value": "T124167D2BB2A354FCC15BD030979FD673A835B4F801317D7B26809A352E72E605B69F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327781, "uuid": "6f0b6952-a148-4e75-8572-90ff79f59184", "value": "98304:rOMUTZs37lmhsUoj+o/mcITAVyDBTz3NehBwMBvZgV:OsFSTz3NehnBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327781, "uuid": "87be59d4-baa1-4b18-b57c-447d0799f4ab", "value": 4205848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327781, "uuid": "64418bda-93a2-4fab-8d48-152c1ae185b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327781, "uuid": "22ce1c36-611f-444c-a101-b5209d7c2302", "value": "0ca3a4c2800f9454cdcbb8398a7ec97b00f90f4234c7c5e48e206a8352d86750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad0d4b1-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372849, "uuid": "e8843dd9-fdaf-406b-90da-6b0ade8d862b", "comment": "Malware payload", "value": "1c1cec16acf30bb3680b9c77d5959539", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372849, "uuid": "13f07115-fc57-4135-ba11-d77cd2b412d9", "comment": "Malware payload", "value": "5c6c49e8e282bef4c70c9decdd1e2100adae553b2c0a0d99dc5a121e93321ccc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372849, "uuid": "a8f6647c-e3dc-476c-9c5e-a0f7c151de0b", "comment": "Malware payload", "value": "ba3fcda1582830fff9c433d0feb1ef835b5b166e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372849, "uuid": "fc6f0a54-9358-43bf-8913-36c0b50b8231", "comment": "Malware payload", "value": "4ed6cb00c2047a3809274f0cca5e95258d8a868f2d9494536e606bee755490d6d640a77a3dca26986ac2dc5f0c21ac4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372849, "uuid": "ef7cf4b5-1119-4ca3-ac5a-93b462f921df", "value": "T117C40245E95FBCE9D83A42F48577850A2033FDA64878651F0604FA3A3DB75C3F92AE06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372849, "uuid": "6debf6ac-c681-47e6-a13e-15cd95560729", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372849, "uuid": "ab51cd86-d783-41f8-9a1b-6a99a0e848a5", "value": "12288:M70ZBbkmxoIV5uA9iRN9CWa2k6bwaUwyWMEEzLNYE2Dn/q5f1:M7sbkmxFV5DiXeAweMZLNX2Dn29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372849, "uuid": "f68285d5-5b73-4dcc-9565-0f96a44cf3ca", "value": 564296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372849, "uuid": "6107ba54-f557-4a14-806e-c58eafa756f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372849, "uuid": "4aa6d6fe-0ec1-4064-bcbe-9d78380799e7", "value": "5c6c49e8e282bef4c70c9decdd1e2100adae553b2c0a0d99dc5a121e93321ccc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36373924-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356843, "uuid": "db7cea20-2bcb-4768-9c72-8a82fca56efa", "comment": "Malware payload (Mirai)", "value": "7343f1b1370ab5ce0565d05ebd4d2d57", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356843, "uuid": "47db29bd-0e0f-4356-92ca-c1f62fcf08ec", "comment": "Malware payload (Mirai)", "value": "5c8b11a39aa0cefad77db32d13bef0a3968bf7f0a4f439d346cd5a625850caa5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356843, "uuid": "7ec0f2b7-5095-4010-85ae-3eb972236110", "comment": "Malware payload (Mirai)", "value": "b9613c0a53e7b3d0c68b238367d3d3e72919dc05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356843, "uuid": "ebaf78d0-cd7b-4d36-8521-acdeb81dd120", "comment": "Malware payload (Mirai)", "value": "b850eef204c66c0f475858fe60da35a0b53071939cbfa153ad8a85d19bdfd978c032537e6e451db36342def7887ebee2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356843, "uuid": "3aab5d92-1ee2-4999-b03c-f56b2386a5ba", "value": "T170835C2731395607D0E1E1BB11F74B22B2D20BCE6358D28EBFA20D9F9E153506A66DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356843, "uuid": "aea7b915-5a62-48c0-bc5c-69beac0278fd", "value": "1536:oSSpuNyJHa2glVXcyGDxyS6DLWR/e9OsodPSwwhsfiV09bdUJdOoi:oStNHXMFP1S3pGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356843, "uuid": "b03f2c1b-8895-491c-b0b0-279f82f1012f", "value": 86444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356843, "uuid": "c23612de-a908-495e-8477-a5a4d92a2cd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356843, "uuid": "cac7c40e-671b-4036-b121-c1d0bedcf7fd", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d85587d-9471-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786334924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334924, "uuid": "e98cb4a6-4901-4708-8529-d12d8e828785", "comment": "Malware payload", "value": "68efd585e5ba88f56da05ca6fd7ee7a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334924, "uuid": "151c5b93-c2b4-4653-a2cb-dfcdbb41537e", "comment": "Malware payload", "value": "5c93a036c695dfba618e2df0dcdd28be50a352f1f7fea01803298a6876e72b6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334924, "uuid": "da2bcb45-9104-4fe7-9dcc-7d4d50b99b38", "comment": "Malware payload", "value": "90d763c0d5b7c22f92f8147b83beb0bf193e0698", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334924, "uuid": "d6dfd215-cd93-497d-8669-bc030706ab24", "comment": "Malware payload", "value": "dc022049aa2a7b3e3bc7c585a5e4c11c5934d6f7af93a1f74d17f123dbcdf1a861b1b49e3cc9f0042aa3dcbaae2b47e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334924, "uuid": "e7fc2388-1af4-46b9-be45-421a291127fc", "value": "T1F7055C12FF4C6417C70A06B0A56E5B7CFB52745381F9C6033B0866AF64D233A5DABE89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334924, "uuid": "6d1153cc-2749-4136-8d2b-8b2475608549", "value": "24576:4/OLQs+mAVdT5KXrwfIVl+lK4Xa3UYYYvg5xq7g2/rpKlG2dPR97:4/1mAVdT5KXrwfIVl+lK4XIvg5xqU2/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786334924, "uuid": "806ad8e7-5c14-44cf-8c6b-b7effa6b7e5c", "value": 860392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786334924, "uuid": "4a7d794f-8587-46ea-b14d-69874c1ebcbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334924, "uuid": "2f26c644-48d2-4a6c-8388-3e24793043ff", "value": "5c93a036c695dfba618e2df0dcdd28be50a352f1f7fea01803298a6876e72b6b.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd8ab6c-946a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786332236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332236, "uuid": "7101b0fa-e860-46e6-9cd3-d915bea5b850", "comment": "Malware payload", "value": "b17305e149026fb6131f23377e58fe5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332236, "uuid": "a0192f06-1767-40d8-89b7-3be5fd53f60e", "comment": "Malware payload", "value": "5cb992f1861f3d9bee208f597f9925a3eb7a5bc4d482a219b5610ba5dbc4fc1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332236, "uuid": "786d1c19-7236-47bb-9d9b-2562b8527ccb", "comment": "Malware payload", "value": "967901c2ab0654609ce088950380cac22ee32300", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786332236, "uuid": "f41e13b8-0643-4957-adc4-ada7e22bd81a", "comment": "Malware payload", "value": "c80cebc726dd7dcb11af54026303703fbba3af530f146f21dd11a9faafe5c54a9ce6d889cffe75070436cb5d2fbd98b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332236, "uuid": "0fe48b75-3836-429d-abbf-6975932ef245", "value": "T13BD52398B9FB19B4C473CBB68F47F0BDB02577864B918E03F68D6A109D12594A93B730", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332236, "uuid": "72468cec-d94d-41d9-9255-23a70839d5a1", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332236, "uuid": "6660fef9-e451-49a3-88db-bce7980f4ec0", "value": "49152:Jr1vz3JnN5QKDdj9vynhTq1y9cp11pN/5RN1w3H4MaQbPh:JZ3NNaS9vaY/VPNK3Y2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786332236, "uuid": "151b0092-0835-4fba-a3be-1bba621bb7bf", "value": 2917376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786332236, "uuid": "776f3cba-3c46-43de-8c7f-953fe888bbce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786332236, "uuid": "32992b8f-d9f2-43e2-92aa-50daf9ed13c1", "value": "5cb992f1861f3d9bee208f597f9925a3eb7a5bc4d482a219b5610ba5dbc4fc1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e35496-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786370507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370507, "uuid": "7cfa082c-0d79-4ce2-a7ef-210ecb27a5e4", "comment": "Malware payload (RemcosRAT)", "value": "762bf3c0b46f6fb04058851ac823f923", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370507, "uuid": "a735af5e-6099-496c-9997-3e400aa8bfa1", "comment": "Malware payload (RemcosRAT)", "value": "5d13cfc9ec95b80219e759f945661eb22e4781df28a181474a040dc72068562b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370507, "uuid": "3ac9f94a-5753-45c1-b94c-ffc5a65b89b0", "comment": "Malware payload (RemcosRAT)", "value": "f1a8c046a026526efb2731c711bb31e834a0a5f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370507, "uuid": "22dab475-0b9a-43c0-a55e-f1353adc3f8c", "comment": "Malware payload (RemcosRAT)", "value": "40bb6afeca06301fb99245c7bcb120fad711c745b39f7fc88fa6e6645583cf5df153c913da01b160b3f50f1e51032bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370507, "uuid": "ed672da9-0edc-4414-9170-ee1e98a83ee9", "value": "T13D0512A46E1EDC12C49327B44AA0F37523A95DD8FD59C2229BFCEED77C29D0B6C08950", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370507, "uuid": "97399d5f-f4fb-4447-8808-f3f2d3203996", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370507, "uuid": "4c46be8c-0820-446c-b3f8-0c19e95d002b", "value": "12288:2WpwZqv7MmCWWBr2XkxkhEQSi7kCRcXzP8GfaJ/pQhf7q4:xpwgv7MnBCXk6EMYCIE5lIf79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370507, "uuid": "707422a7-2961-41a4-b94f-dd06b03528de", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370507, "uuid": "d74411bc-e549-44dc-8820-e06166c1281f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370507, "uuid": "330f44b8-a507-4a9f-8a5e-d6ef13d512ae", "value": "5d13cfc9ec95b80219e759f945661eb22e4781df28a181474a040dc72068562b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa678d7-9513-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786404631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404631, "uuid": "8cfeaad6-9d29-4d1e-b190-11a8ab844f72", "comment": "Malware payload (Mirai)", "value": "2719b7320d322742ada0faf8d9689270", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404631, "uuid": "39cb2057-559a-4b2b-a77c-3b26550c6fc7", "comment": "Malware payload (Mirai)", "value": "5d30e09fd80ce4ba08374d63c94dc2e12e1e059fa75f1c4151ac34bd9ccfd92d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404631, "uuid": "94835368-6a15-4fba-ac12-8b09d9655c8d", "comment": "Malware payload (Mirai)", "value": "c8985ebc5c4abf90d8beafce2b0477398087eeb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404631, "uuid": "cbd52b12-366d-4425-8610-7d7af75ae032", "comment": "Malware payload (Mirai)", "value": "e628b25af27e60fb63bff3b313819c328ccf4c167ccd6d44a078a93ffed060255edf958f1f72d6fb13e1e8917756bc2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404631, "uuid": "87ed6203-4113-4471-b7d6-18329de981a5", "value": "T17403F841759184FEC05AC2349B7EE52BE932785E32317A5FB789BB351E32D301E0B691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404631, "uuid": "ebfd1847-808a-4b73-912b-c8f2976d71bd", "value": "768:zyLTIgJU9KXhS5bY6ho+97glpTYTCicKrem:zBS/2bY017gllYS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786404631, "uuid": "60f29f23-218e-443a-8069-3ee2dcc90887", "value": 38760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786404631, "uuid": "75f5f5c4-c26f-4d2e-a145-07c3a2a2c084", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404631, "uuid": "2d0b83ab-660f-4a9a-bd99-7de94b190904", "value": "mini.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cddc960-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369255, "uuid": "ad6f656f-589c-429d-bc41-9bdd053b0130", "comment": "Malware payload (Vidar)", "value": "d18005d989a63244921843939da6ef2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369255, "uuid": "cf6c91af-2e7d-47ce-8375-d26b104ef737", "comment": "Malware payload (Vidar)", "value": "5d6658f6472e0a13c142496c831d215016a3f141c580a1a679eef43bde834136", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369255, "uuid": "e0d30cf0-de62-483a-a2c2-41614375fb2a", "comment": "Malware payload (Vidar)", "value": "5f25f27872e5191af5ce34312c56bb4aac3ee521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369255, "uuid": "2fbf5b4a-840a-427b-bccd-948a5b33e4ad", "comment": "Malware payload (Vidar)", "value": "7ac5c92ed5e21ff11d35b9062e4ae09d3846171fd68b6324dd73b7db2e6ca98d6cb97caaa6cd83a75da0d2b9dde72265", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369255, "uuid": "640bc425-b049-4956-953e-ce5f62c22602", "value": "T1FD927145E0179AE4C4E6C337A76652A765FCB8603136673FABDC9A3A0D52330A7403ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369255, "uuid": "0e5e1f35-dd57-426f-ae84-395ea3f92996", "value": "6dc49e85762e4ee01dd5464c00241541", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369255, "uuid": "b528d6de-b788-4170-a301-56b2db0325d3", "value": "384:OJRE5NPItXZ2CyX5Bg19xP+Ma4RMsZF4rKl3lOO:62rPasBg19xPSoOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369255, "uuid": "80a965cb-4b5c-41cd-a5d0-6f1c7d1f83fe", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369255, "uuid": "d5079b44-2914-4423-87d4-f0456ad93bc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369255, "uuid": "945cc126-87c7-4965-af5c-d915f0e3e5b4", "value": "5d6658f6472e0a13c142496c831d215016a3f141c580a1a679eef43bde834136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fec0427-9497-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786351383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351383, "uuid": "b0431a34-6805-42d5-b5b1-75758185aa5b", "comment": "Malware payload (Formbook)", "value": "59e90d4e4072484541636b873c35a4a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351383, "uuid": "9ce57e86-2f01-4385-b48c-69560057d050", "comment": "Malware payload (Formbook)", "value": "5d8353255bc5b09aaed218f2d6f016ceda78354cfb1a3f0d36d939d142f3a8f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351383, "uuid": "05181cc3-a244-42ee-894b-708e61f6646a", "comment": "Malware payload (Formbook)", "value": "673a985979c3381c4b1b5103816a0a2a11f29bee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786351383, "uuid": "6009c864-58aa-4b25-8ec0-6229a4dba0db", "comment": "Malware payload (Formbook)", "value": "24bad2f0ecaadf5a33036dff6124ea63e384e86c6231622e1b5b2c5a55129a1fd38b8754ae8bedf89e74d9f53848937b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351383, "uuid": "6a4d5be1-edb4-4e92-89f4-d5659b09557b", "value": "T1DD350254236FDC13C0934B7848B0D7B4527D9E88A852D3079EFE7E8775AB79A2C482D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351383, "uuid": "a44e14da-3100-4563-ab12-eab398b48e8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351383, "uuid": "8b272d1d-5c52-4f30-b242-729a2ad2d28f", "value": "24576:JgrWvYQmOOlGWiSAGhc26YxZ7sHMie+z3kdz:JtAYaiSAGGqlsja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786351383, "uuid": "fdbbd9eb-41f3-457a-9184-f2f6c7a8e92f", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786351383, "uuid": "4a9c1309-ed18-4c4f-b5ba-5e8d54250a69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786351383, "uuid": "a2082bd8-ff37-429b-8820-b6706c254385", "value": "SecuriteInfo.com.Trojan.Inject7.763.23737.20123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce2914b-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1786372316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372316, "uuid": "7cb7fe16-2617-4e8e-a08c-90761875cbc9", "comment": "Malware payload (Phorpiex)", "value": "cc06b4c7fae79e0b4977f26b8883e62d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372316, "uuid": "2f50ef51-e9f1-4471-84f0-2c997d6d2938", "comment": "Malware payload (Phorpiex)", "value": "5d8fb52c70211fca8f75e26173d9a393b76a23f446c773f1238ddd7213756aac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372316, "uuid": "f31ae392-9234-4e21-9ec2-0faffe64b36b", "comment": "Malware payload (Phorpiex)", "value": "a7b1868b14662daff4e7f3cafc54eb1c9785d37c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372316, "uuid": "2103bc6c-283f-491e-8212-7526cf7690f0", "comment": "Malware payload (Phorpiex)", "value": "8d2b5451bb0100d1ee644d6930f4aaa71cb727858f1b28a5c4626a0fad161ae79fa2541ec04467ed64c2f039f7a04bb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372316, "uuid": "62a13105-61ad-49c7-ab6d-9eac15f8bdb8", "value": "T12E55BF21B69790F3D6563A7014BA2B3F9E3DAA460F15CBC39364EE2C5C321C19D3715A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372316, "uuid": "bbe43c2b-7a72-45ec-a912-f6535d3916ae", "value": "4ca36c0623611345ee5fabf3cf68d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372316, "uuid": "59b5d13b-d0ed-4e27-a991-77966b44ca52", "value": "24576:TlNV2ZTHxI0xvmodlG4u0sfOa49SkQwFn3nWBWic9uRCU7r:RNV2Z+0xJlG4lwd49Wmtic9Kr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372316, "uuid": "322e9228-e6fd-4dfb-af9f-e24ae114d564", "value": 1314816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372316, "uuid": "6785af0a-a6f4-4776-ad9d-3d3a6f6221ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372316, "uuid": "ec45885a-1225-42e5-91fb-a0701f606880", "value": "5d8fb52c70211fca8f75e26173d9a393b76a23f446c773f1238ddd7213756aac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8f62b1-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (LXKeylogger)", "timestamp": 1786371428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371428, "uuid": "c440fb9b-7bc5-46f5-ac9a-129f013bedcb", "comment": "Malware payload (LXKeylogger)", "value": "10b6c33de8cbe29c6991f3e814c58b6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LXKeylogger", "colour": "#B359B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371428, "uuid": "25f3da72-a192-4ea4-9d60-2301e308ac32", "comment": "Malware payload (LXKeylogger)", "value": "5d9386cefd8e46a8731b990925ca01c5cec5bc1dd0b46e4f81ef83fd5a308407", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LXKeylogger", "colour": "#B359B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371428, "uuid": "cfb76430-70f3-4a8d-a091-df89a528feea", "comment": "Malware payload (LXKeylogger)", "value": "71f1c5e8a1256de7aa66f7bce95f38df81b041b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LXKeylogger", "colour": "#B359B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371428, "uuid": "a35a1041-2294-4657-8b80-373d4155fd03", "comment": "Malware payload (LXKeylogger)", "value": "c6b48892f2ec18d340e2f62891f0d5fcba96d5ef6d0333dd423467de7102ea42dd7d576444da62c7aee492e9c6568fcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LXKeylogger", "colour": "#B359B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371428, "uuid": "02ca737d-5d71-472a-a0de-4eff35fa3810", "value": "T172356B0573A441EDFEABE4768B13C617C7B278450237961F06A06A766F33BB16A2F311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371428, "uuid": "771c3dc0-722f-41ee-a0ec-9bf4d1c93cdd", "value": "638af1c562ad8f76992023c9692ec222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371428, "uuid": "102402c1-833b-4db1-ab1b-75df56148bc0", "value": "24576:mCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrE4H4444Ckf:t1H4jR2TYrQbDTrE4H4444Ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371428, "uuid": "40f1f2ae-7308-4823-9baf-58be654fd947", "value": 1114112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371428, "uuid": "8128249f-d9fc-4d0b-8b56-46818912b0e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371428, "uuid": "c6def4c7-f93a-4e64-8c8e-293950f9f7b0", "value": "5d9386cefd8e46a8731b990925ca01c5cec5bc1dd0b46e4f81ef83fd5a308407", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c10751-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786374100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374100, "uuid": "690a13d8-47bc-436c-ae6f-0cbe96254d14", "comment": "Malware payload (GuLoader)", "value": "9bbf2c2c831baf0d97f36cf097885e81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374100, "uuid": "159ddd69-34da-4066-9c8b-848e05157c17", "comment": "Malware payload (GuLoader)", "value": "5de6bcfc6e324816d9b4c7363785e986006395b14d707ddddd3229f249f5b1a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374100, "uuid": "820d9e61-694f-4a06-9559-511d0b25e0e3", "comment": "Malware payload (GuLoader)", "value": "0a351f965717fa36b2d51edc93876ce82457dff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374100, "uuid": "b072fb59-b892-48ac-ac2b-caae54203c48", "comment": "Malware payload (GuLoader)", "value": "974f8bd41dffb8927ac583e8a0ecec8bb2712572c9bbb00c74cf393e970d1a6e67b1e9e06c4ffd31a0b69a94a185d99e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374100, "uuid": "9004b483-08ab-499a-8220-7cab48d89b8a", "value": "T1CF7413857640D0A7E67347324EFF12219EB6FE453BA45A4F13042F56FE32A50DB1E289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374100, "uuid": "b8727d95-547a-4bd9-bc4a-e14fd227b430", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374100, "uuid": "79210525-6315-4ba3-ae88-eefbcfff0fb9", "value": "6144:kXsKoGhhRXLqGqpHLB4d9oZmE3ePeFzjvkQNNac5YC40c0YtjMpXM24FpdVPVnSt:kX9hRXbqxaKA7P2PsqNaW34OUMpXf4FU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374100, "uuid": "7e5fa9f7-87d7-4ddd-8f80-402536e9fafd", "value": 347800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374100, "uuid": "288aed80-c82e-438a-a5d5-1287ba8b75d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374100, "uuid": "5c0cc8f7-566c-4320-91a5-21aa9aa6033d", "value": "5de6bcfc6e324816d9b4c7363785e986006395b14d707ddddd3229f249f5b1a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e7f155-9466-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786330425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330425, "uuid": "0db3860f-a31d-4f78-bb16-99471cf55124", "comment": "Malware payload", "value": "3260c425f1d0425e1fdc18cd18e5fd66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330425, "uuid": "e0bb672d-9ded-4719-a95a-222255312ad7", "comment": "Malware payload", "value": "5de9e5222b6a16dde58b9388782b7b3115fe8c8405455e1fc54dc37a2bbd99d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330425, "uuid": "5692735f-dd9c-4ffc-ad1b-c1ba28ca9458", "comment": "Malware payload", "value": "03025164b8b043b85d282cedd7a561db08ffac76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330425, "uuid": "e16d57a6-d1db-49ac-8dcd-f884a6017438", "comment": "Malware payload", "value": "7b2c17bf426dad6f00fe952cb02d81dd70d790e951d5b5b32453b272080a1c8cbcfe6810ae8dab2a23e591abf27dae87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330425, "uuid": "4cb8e2b2-b27c-4796-bc9b-bac55f37d4f3", "value": "T12B031B46EA519B09C6D272BEFB8E014E37176FA8E3ED32359E306FE013825E70935525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330425, "uuid": "96d14643-f17b-406f-a713-24b47051e4dc", "value": "768:MknVZ7W0BFWJpzunYeNLDvm9pJ5M8Leio6hg+wd9SaVjHOyh:MknV9VBFWJpSY2SjDMTio6e+wdROyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786330425, "uuid": "c780297b-36d2-4a8e-9a73-58acb4a238db", "value": 41128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786330425, "uuid": "a37ba727-9706-4b8e-baac-a231ce03bc7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330425, "uuid": "d8e7b9a6-31c4-4d5e-a602-63060f9e1013", "value": "main.armv4tl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053c7bc5-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786371793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371793, "uuid": "f177e820-aad3-4efb-8ba2-6b16fd789fda", "comment": "Malware payload (AsyncRAT)", "value": "ff937dfbe6555ebce215fb444f1a9a9a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371793, "uuid": "3ac7e751-e1c2-4fc8-bd50-43565c6eef69", "comment": "Malware payload (AsyncRAT)", "value": "5e367c100af535fbbb49cab79f9d566f2f2681d01c038ec51c7ebc5ce703ae7f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371793, "uuid": "fe4f737d-a853-44b0-ab64-4d7941fac500", "comment": "Malware payload (AsyncRAT)", "value": "7668bfbf55145209c9a8b9ae770399a100186700", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371793, "uuid": "c673728a-2fc2-4b2a-96b8-22957b6754a2", "comment": "Malware payload (AsyncRAT)", "value": "938375a0b717abb8f81307539970e669655a00452782f62d9c314781c2713f2ac01f309c1344c2eb35713f0e7d776a9f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371793, "uuid": "6f0d8ce2-736b-4512-8a6e-bfd1f916919e", "value": "T134F412286216E907C95117344AA1F2B463F89EDAF503C22BBBED6EEBB533B454D401D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371793, "uuid": "ea5e8146-8f53-468d-b105-469bf962e942", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371793, "uuid": "d072ec00-deb0-4359-a94d-4d314fa9a39e", "value": "12288:F+lJdbpYaD3oReS7Vb7wTgf0giyU6eAElJOzwtQRbgOzxdqoj3spyIkAj:F+HYa8ReS7Vb7Ogf0NRVistOtgIspyIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371793, "uuid": "d6e125ca-e19a-4d50-8776-63dbdab0218d", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371793, "uuid": "ea57cb6e-6ef0-45f0-b5d5-9387e8a339ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371793, "uuid": "0fefa644-c904-4025-9653-aa64e08dea54", "value": "5e367c100af535fbbb49cab79f9d566f2f2681d01c038ec51c7ebc5ce703ae7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "058834f2-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371364, "uuid": "b6942d18-a406-4866-b5f4-1818523338eb", "comment": "Malware payload (AgentTesla)", "value": "f3ef9b4cf25df36beba17cc38d1e3976", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371364, "uuid": "4c7ddcf5-7c49-4bc6-b8b2-134661c5854c", "comment": "Malware payload (AgentTesla)", "value": "5e6d5e2e3318df276f5557fa7728989034c355a35ad8ef2c5266479e73d71457", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371364, "uuid": "5f503fe2-7b49-450c-8bc1-9ee97a14c84e", "comment": "Malware payload (AgentTesla)", "value": "1e82fd4a9b84879a5355978aec76631c7dc3a07a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371364, "uuid": "4a816e7c-9a17-497c-9bee-5571b6835daa", "comment": "Malware payload (AgentTesla)", "value": "52cc21359214c18fcb5f73f9fda208a61739b4da9560953ccb265b17487463cc3aa027a2c10f5dd9b9a4440c414172c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371364, "uuid": "8a65dcb0-a91b-4dc5-96e0-4b5291325b30", "value": "T1213501389D8B5A60CB7D1B78C16618AC23F0C553E257DB2F3EFD91F49BA2794A817042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371364, "uuid": "6b5dff4c-02dd-407c-993d-5fede398f4e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371364, "uuid": "6770dd68-afa1-4cf5-b2cb-fd7c837393c5", "value": "24576:4gn1u2UxAPqGcv/+Duyx416HzL8Ew2GClGv:4g16qPRcvE5HzIEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371364, "uuid": "b1e43282-900f-4ff8-9add-b9bab80ff050", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371364, "uuid": "691c68d8-8ff9-4a9a-9531-b2ab37509fd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371364, "uuid": "8ded6440-1002-4f88-8d1b-0fc0c21e55e8", "value": "5e6d5e2e3318df276f5557fa7728989034c355a35ad8ef2c5266479e73d71457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94404561-94a9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786359148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359148, "uuid": "58bb119c-d1d0-4694-9bac-b1e5e6bafc44", "comment": "Malware payload (Efimer)", "value": "35c4db4b3d5e5476260429618c85b893", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359148, "uuid": "0c82d4f7-643c-4759-8cdb-df9b0c16d159", "comment": "Malware payload (Efimer)", "value": "5f3f2f5b15455104ffae6d588c15e3e66c6f851f698956ed2fa2494135485b92", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359148, "uuid": "c7247520-c9a2-470e-a4da-ba69ef87dcbf", "comment": "Malware payload (Efimer)", "value": "a06968a0f3b7b985761ea55d5be1aea1a93826cc", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786359148, "uuid": "bab38e31-9d87-4b6b-91be-6e23f23380ea", "comment": "Malware payload (Efimer)", "value": "1e00f12c8da86a704fc0aa55b336bc811d27c93a4bab5bb6844c4d0d53e5af387fe2a05d14fec79f75d6ec6180ce108e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359148, "uuid": "296cb54f-ef81-4af5-849d-47580584f05c", "value": "T1DEE6331861D002FED9B3993DED925585EA72B4379B32C9C74B5847E69E232E08C3C763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359148, "uuid": "e6396838-8d4b-4e1c-9a83-7585d0f5085f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359148, "uuid": "af9bc70c-14f1-4b18-9895-2a1aa93928fa", "value": "393216:6YGmazx0Gdxkb/qZabbMXMCHWUjQcuI3/PGTAI:JGFnxKaaPMXMb8FH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786359148, "uuid": "e9487590-ca3a-46df-88ff-230e94a8c2f1", "value": 14273697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786359148, "uuid": "b3f25228-6a99-4b87-91c1-d244f676555a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786359148, "uuid": "01d8440d-592b-416b-82a9-53f298c6d43b", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fb43cc-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786370739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370739, "uuid": "44d44380-9aa3-4f31-b289-3fe80170014f", "comment": "Malware payload (AgentTesla)", "value": "0c2d59652cd96474c1c7cebe66860aff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370739, "uuid": "3b36a8b8-b363-45fc-a65f-217d83c9a8a6", "comment": "Malware payload (AgentTesla)", "value": "5f5a651b70cbc2315ca3ac61856cfab551119849e1676729f51a12e558e7d68e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370739, "uuid": "c84c8416-7999-4967-803f-f9a67e105924", "comment": "Malware payload (AgentTesla)", "value": "a2b8d375363dd0e46721facd6cf061cefe23062d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370739, "uuid": "85bb3bd0-4d58-4cf5-80bc-a6360a0ae417", "comment": "Malware payload (AgentTesla)", "value": "b7eb40dee3947db2948274a95245994720e3a1dcc839d63f152d792457b47563cf971c81db3bc2dfdfb59426353f9271", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370739, "uuid": "6cd8b114-20ca-4288-8776-d6f3b647b105", "value": "T1EF3512196A89DC15C5E207B564F0E33863F77E9CA421C21A4FECBEDB3D12B025D18B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370739, "uuid": "bc8d3fcc-c38f-4cb7-bcd9-842d99f3bc75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370739, "uuid": "76d09218-0b96-4d78-9a7f-fe42d8b34a95", "value": "12288:RcMUHYwDc8u6GLUEUJlDODtj33K5S0/cR5P+KDOHq4TOEXgc7SyTYOBRPlxyLS/F:gODR3ReHqCOs9Rtxr/vS0Lu41UI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370739, "uuid": "616b0ea0-dc7f-462d-8d50-c955d4e0c536", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370739, "uuid": "92938d19-7093-4af9-8c1a-113147be2c9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370739, "uuid": "483b72cc-ac8b-46f5-8e93-c439469f6777", "value": "5f5a651b70cbc2315ca3ac61856cfab551119849e1676729f51a12e558e7d68e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c47cee9-949d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786353819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353819, "uuid": "2e427898-12f7-4e27-8573-29f97be4faa3", "comment": "Malware payload (Mirai)", "value": "2a2175db00cd936a31e9de6d103c37dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353819, "uuid": "a1c29d28-157e-4c95-8dd3-ac12b5246cf6", "comment": "Malware payload (Mirai)", "value": "5fe771dcafd255f49fcd226534ed1eb00ebad5d120e4426217efc67a305bd7a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353819, "uuid": "b466f876-7512-40b9-bcc6-22b5d60cbc56", "comment": "Malware payload (Mirai)", "value": "fe7b6f91f7c80383431db184426c69c4dc0a89af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353819, "uuid": "e7194565-00ee-4b5e-9c60-f9446d79f6ef", "comment": "Malware payload (Mirai)", "value": "00e2bddb752cccd7fa29c4047a70f4a66ddfb2a95057166608813161f5f113feb61bb95f8d1ea1045ac0e3c8c0ae0dfa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353819, "uuid": "6b5818f0-e3d8-48fd-9ee4-31a670ce6115", "value": "T123042B03771C0A83C15B6EF03AFB27F187ABE95115A66280F21FFE845332AB06559F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353819, "uuid": "cb9b51a3-5a74-4cb2-8404-9e2904865a49", "value": "3072:8jQYjLyxQactlYC6UrVO9GYjM5/GKTK6vFBv7oxXkl2CLf5QwD:8/uxQamlYFnXO/FTK6vFBv7oxXkl2CL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353819, "uuid": "c51cf38f-82d0-4bd3-9f65-8f8282a75e51", "value": 175339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353819, "uuid": "c2606538-b777-4186-b7dc-17b0b0c9dfb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353819, "uuid": "8d14b206-6fce-42b5-bbff-e19076b7cae8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaef18b6-947f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786341147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341147, "uuid": "1d082c46-41cc-4b28-a989-0ec94b449c20", "comment": "Malware payload (Efimer)", "value": "4f370e399bd2284ea493aa976696c794", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341147, "uuid": "5fb44b3a-bf38-4e7f-b1ef-02341eb700f6", "comment": "Malware payload (Efimer)", "value": "5ff2d917b5e93af56e24fa6c5e414f9679381f5b7da0c2d597d8c7536a9aff90", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341147, "uuid": "b263da9b-3ab8-4d6e-be1d-edfb65ea1e5c", "comment": "Malware payload (Efimer)", "value": "21fbe76279a10a7711b92041efd096ca25f483be", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341147, "uuid": "5d17418d-b186-4c5a-ac5c-c4a7f705a89c", "comment": "Malware payload (Efimer)", "value": "238f4192c7e4f96eed1ced00a70436878f637428e5e9ee0bd16b39114e5457e4ab9fe00ad633193b12d012197907b89a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341147, "uuid": "2f7df8f6-019c-47cd-b169-624049d24c13", "value": "T1CDE63348A5D017AEFA73A43D99D04155F4B8B86B5775C68F87A8C3902D133E0CA3EF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341147, "uuid": "3e396397-6a69-4948-9632-c8c591a854ca", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341147, "uuid": "d12d0fd8-edae-46bd-8d39-a10a48282bb2", "value": "393216:zGm8QD8+Vjby3C7DjkHv7YD/MTgZcuxXMCHWUj5cuI3/PGTAI:zGSfYC7Dj6YD/TPxXMb8OH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786341147, "uuid": "c9a802ea-16c7-4515-aea6-7ce3adbc91ed", "value": 14279847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786341147, "uuid": "014c4a4a-4dd6-45ff-87b7-bf4a27a0eb0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341147, "uuid": "2c9ed4bf-5ea8-4530-b827-393c98f8af71", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148a4d5b-9463-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786328869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328869, "uuid": "ce870080-0a8e-4da7-aa4c-fae9488d1b8f", "comment": "Malware payload (Mirai)", "value": "529427dd9a950d6233d9bb4a1c3b2e93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328869, "uuid": "44155bfe-7104-47f5-a9b2-4f5d38aeda29", "comment": "Malware payload (Mirai)", "value": "605108764fe03fc94d3d631ba09abc815cdbaacf2d4414a7aafc06934a83f163", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328869, "uuid": "2294a4f6-917a-4229-bbc0-732e48ec6a86", "comment": "Malware payload (Mirai)", "value": "363baa9c661d95936d17c9d97454c331d790091f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328869, "uuid": "e0fc3be0-e364-418d-b629-e1f2e83de13e", "comment": "Malware payload (Mirai)", "value": "d9b6518c09185c92f339b42d01dd8be6a26913b271c6979013d54f77c168713d2da842c8be0bcb96ea893af5b476f1b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328869, "uuid": "699e893c-88dc-4567-8307-cf80e207b378", "value": "T1ADF2E16E70D4789EEFEC4C79420CE7216E55F0C0B28397DEEFE05AD95A35A17D44900A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328869, "uuid": "12cb421d-12af-4106-90a0-0992fcc32225", "value": "768:lGwiPffsTuFG2qcheO7GQUOLz6hPxv03XijEWM3j:1iPfiuFGANGQUX8nij6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328869, "uuid": "5678c626-0755-43cf-9252-c43924b00071", "value": 35760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328869, "uuid": "5aaa8ecc-6131-4b5c-98b0-5934c2d0c856", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328869, "uuid": "816dfca1-ed83-4bab-aa33-1ff605021600", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69788421-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373249, "uuid": "5e065f79-0079-4faf-966b-781e79938e0a", "comment": "Malware payload (AgentTesla)", "value": "cea61145d549ca41d560abf4c6d4eb2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373249, "uuid": "ee153f7a-abdb-432a-8e27-55794a6ddd13", "comment": "Malware payload (AgentTesla)", "value": "6068dcaebde7c4acdc37d90fdd8b513d08c294e8608e1938c13039380f5c136f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373249, "uuid": "cb11967e-219d-41b7-a221-32534efcaf8c", "comment": "Malware payload (AgentTesla)", "value": "7cc0c7c6d1c0011ff6e51dcc849733d1940006c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373249, "uuid": "67ed6ae0-9e00-45ae-a5b8-34502fd5a823", "comment": "Malware payload (AgentTesla)", "value": "06cb7d7df75b490b99c7bd930eba354864537c22208424ffe3460d73a3bfbc9b95f004f98a672d028a3307ea818a8d52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373249, "uuid": "e19334b8-0ecb-4da7-b17a-e19babf4a1da", "value": "T1483502B25DC72A58CB380FB4C272499423F09A4B8266D76B2EFD41F49F923C95E27147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373249, "uuid": "82b3df14-58cf-439d-83ad-f17b8c1fc732", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373249, "uuid": "95aa2fba-5e30-4b62-965f-188e5ec2c12f", "value": "24576:C4jxUYaVWgYfTfn/oTgPQHo0+4lW+/CiKKzyg2:C4jiYaLoTYgoI09lWvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373249, "uuid": "5c6fa58f-50c6-4677-b3a4-70fc41f6801e", "value": 1132544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373249, "uuid": "8fdd3b48-cfa6-4ee9-a551-13f545fb95be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373249, "uuid": "582965a0-4952-4306-8d93-b7b8f175497e", "value": "6068dcaebde7c4acdc37d90fdd8b513d08c294e8608e1938c13039380f5c136f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84af902e-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370718, "uuid": "b8501c23-f7b4-4845-aac0-4c9b888986a4", "comment": "Malware payload (Formbook)", "value": "fdb3a110d4eb1003d5d7375125be03e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370718, "uuid": "9231813e-fcbc-4697-b7e3-fcc0dc83925f", "comment": "Malware payload (Formbook)", "value": "6090633f15893014c0ae325f43d048f6a2dac29e0472388f995dc42763e3ce2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370718, "uuid": "e420e233-b16e-40dd-9f00-7bffe0f040ff", "comment": "Malware payload (Formbook)", "value": "1961041009a34ecd4880f1630daee0e3f65e0838", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370718, "uuid": "cdfea804-46ac-49b3-97f4-94cf47fd2fd8", "comment": "Malware payload (Formbook)", "value": "ac0a7632904230ca1e962b7aa3ef473ac9daa77692a291cd44a13a9be1d02c16db46fe728f2186bab3de8beb3db7d2f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370718, "uuid": "beb2424d-a5d7-436d-b099-87ba65cc781c", "value": "T1623512186A4DDE01C4DA0B35E4A0F37953F3BE5CF421D6168FEDAE9B3A227422D08B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370718, "uuid": "7dddffdd-9187-4cf0-bb4a-34b1b33de2bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370718, "uuid": "00a3d0f6-6c0c-472b-8497-d9db62c1646c", "value": "24576:9mdZ3MWuGQaMaj1+uDbHmw30h2o7trcH2+cOPpS0bpuzn5c+bcU:AH3Mx0MCGn2opSddPpppuzn5NbcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370718, "uuid": "3c969a08-2d39-4bda-8d75-856311791c3c", "value": 1136128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370718, "uuid": "ff3fbdab-c204-418d-8aac-b3ab3db9cb56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370718, "uuid": "03fc9504-7639-43b7-bc4d-73be62f4672e", "value": "6090633f15893014c0ae325f43d048f6a2dac29e0472388f995dc42763e3ce2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730bee43-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356945, "uuid": "d0d99249-8411-47ba-9ce4-702e485461af", "comment": "Malware payload (Mirai)", "value": "f509c905a25e136cf24b7805e7e27931", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356945, "uuid": "229d5fc3-501c-4136-9a5d-6a2dcb7a3e40", "comment": "Malware payload (Mirai)", "value": "60a9db1a5e5544f5705216f79c3995f576ceff992700f915d726ad5f12df2d6b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356945, "uuid": "95ef94ec-f26a-43ad-9ce7-6144cd0ac019", "comment": "Malware payload (Mirai)", "value": "c3e86dc617f5b9c56bd634e342b781fb1a300d86", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356945, "uuid": "64a842fb-8f5f-449e-8376-dfbff244a8b4", "comment": "Malware payload (Mirai)", "value": "bd0e69ae29faca5ca3324356144cd1064458a46938bda504dd0698016abb1a580c614d285fe586b0b24c671559308bfe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356945, "uuid": "c51e1639-7c19-463e-8eb7-8a2cfb343e57", "value": "T1E344F80AAF610EFBE8AFDD3712E90B0125CCA54B22A47B357574D518F14E64B1AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356945, "uuid": "57d9f953-c212-4f7f-9bcc-da3b237d697d", "value": "6144:snw+6e+eVEavlfEQ3XI+Sr546V6duhb1AR6Xj5N+Xk0k:iwbHcEavlfDHI+Sr5BV6dqp66Xwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356945, "uuid": "6af38401-1c6f-4f49-b5db-d36052a19de4", "value": 262484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356945, "uuid": "7bc273a9-e97a-4c8f-8c0a-6fc4ef1da352", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356945, "uuid": "2cf27994-6317-4778-8223-44d3cbe0b284", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2a503a-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786370360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370360, "uuid": "3edc2de3-24be-4c67-b228-0b001b9e1ac8", "comment": "Malware payload (AgentTesla)", "value": "26e7c59d95b5b20bee49faae31238fef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370360, "uuid": "764ddd3e-d34c-42e8-bc65-f944aee15459", "comment": "Malware payload (AgentTesla)", "value": "60eba5a1a2fa28987cd59ff28a4f051dbbce369eef926f133914a1bd5ace8204", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370360, "uuid": "4e31e7e3-bb50-4cb0-b78b-8b5f5b03a32e", "comment": "Malware payload (AgentTesla)", "value": "459fcd8675ad1dc52c4474bca8d7efe6da15fb2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370360, "uuid": "c4a50b66-0e54-44bb-b7cf-c5517e9dd671", "comment": "Malware payload (AgentTesla)", "value": "cc2efeecbc4b5ab0c200b960a3d484f1e92cfe14ad90b0cce47240712c9a73ac846eeda34cfc21fde6c9c92e2d3c1af3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370360, "uuid": "2defce86-9e64-4cf3-b2a1-5e9c430141ec", "value": "T1D674BE93F680C6AAFC2D4C75D9A752300B72ADB696C58F4353D879123FB2280753B52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370360, "uuid": "6856d0c2-7858-44c6-88e7-6d6edbd6b825", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370360, "uuid": "717b58db-10a2-4519-bd64-01fd96544956", "value": "6144:YmGIhCrl0WKxHId8CxrM38tm0T0mAfnF5kc/JrJqoAq56zJ:fm0NxodvW38tm0HeIc/RJjAqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370360, "uuid": "502b5783-a531-47fd-8c55-9a015dfdb390", "value": 351576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370360, "uuid": "8f8c65dc-6c70-445e-a704-b65808562567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370360, "uuid": "78c7b4fb-1b46-4a64-bac3-15b11401fa32", "value": "60eba5a1a2fa28987cd59ff28a4f051dbbce369eef926f133914a1bd5ace8204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fdbb82-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368601, "uuid": "a2ad0f47-2306-417d-a0ce-7141303bad6f", "comment": "Malware payload (Formbook)", "value": "84ae5a682fa191f1cb572ce2a6249891", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368601, "uuid": "105a277e-47ab-420f-9d96-04df0229688e", "comment": "Malware payload (Formbook)", "value": "61b8ca3b55464f403f047dec20f0f2338a5c19564b005d505b3e60d12ad5368b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368601, "uuid": "599329f0-0de6-49b4-aad2-0593ad42b815", "comment": "Malware payload (Formbook)", "value": "65de43de02480f1697104e8c367f7c0896c4e46d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368601, "uuid": "7415449d-7ed1-40a5-b781-ad0aabd0eed2", "comment": "Malware payload (Formbook)", "value": "b78937440429fb85ba3c2b51b8a9d6e3319cac4c9c907bbd831646707e2d85fa2e08e66d18098be4ae87a0f76346e978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368601, "uuid": "117260eb-cbe6-473a-978d-aab8f2f1d107", "value": "T16C3502D43B2AB704DEA86934D53AEDB852B51D34B010F9E2AEDE3B4779AD1029D0CF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368601, "uuid": "35cb8647-8d7d-48b8-8530-d5472129a477", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368601, "uuid": "0a02d1e7-11a7-4c40-b081-9aef9977848e", "value": "24576:EDyTqGiMFig6vuvyworjNXYJjHu9I6SosvJMsR:vThiL2vyXrjNXYVwZshNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368601, "uuid": "b3ac4d32-ceae-4c9d-8704-a622ccd2b8b8", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368601, "uuid": "60619995-1b83-4b14-bf60-1e1f6a18dfb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368601, "uuid": "bcd9892a-bf88-4be3-b540-cae758c1e197", "value": "61b8ca3b55464f403f047dec20f0f2338a5c19564b005d505b3e60d12ad5368b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f0b576-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786372225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372225, "uuid": "9f89dc25-372c-4b89-8310-57786024a134", "comment": "Malware payload (RemusStealer)", "value": "23739c41ac6e6ae8a8617f7b6a3bdc7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372225, "uuid": "e9ed2716-c304-42ef-b3e0-d68af91d0735", "comment": "Malware payload (RemusStealer)", "value": "61c0328391ec425664fff03f9dc68ff85c10afcebd57f90b5aadd833a839f452", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372225, "uuid": "9c93d695-62bc-4d7f-9b3d-5e6b323aef46", "comment": "Malware payload (RemusStealer)", "value": "3314f8ee0ed24757009dac65269c13a3425a57db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372225, "uuid": "c9cb0713-cde1-4954-b584-93d6f92f509e", "comment": "Malware payload (RemusStealer)", "value": "7f7b279b11369c6aaad4e50793a10c2239f732cf88326da27b3cb1087c78c5c449e2ea93361ff459eed4d933d571a22c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372225, "uuid": "906a492b-1180-4ccb-9dc9-f6a44ce32a20", "value": "T15B956B4BFCA818F6D0AAA2358C72A2517B30BC450F2123DB2E90B67D2F727E55DB4754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372225, "uuid": "859b943f-4d7a-4264-b6ac-30dc3d48ba93", "value": "9b763104e1c7e7b7334a1e9ed4235cd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372225, "uuid": "61cdf6a2-7359-4c41-8570-c8768d52e9aa", "value": "24576:SJHFHOqF+UMx9xcL1zK7o7VyzAASbyiPjKxSTy:SJHFuqAUMx9xcL1zK7oRyzDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372225, "uuid": "8f7d4b63-a9a4-442d-b515-25ece39b71e4", "value": 2047535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372225, "uuid": "8b062fcd-d31b-43d6-822c-fd7e3344388d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372225, "uuid": "46cde336-b4a0-46f8-a262-43160f96dd8e", "value": "61c0328391ec425664fff03f9dc68ff85c10afcebd57f90b5aadd833a839f452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490a247c-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371477, "uuid": "2870c7de-42b1-48f2-af2e-c3c14cc992f1", "comment": "Malware payload (AgentTesla)", "value": "e9a3c44b564ca978a79e0a5f46460867", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371477, "uuid": "bd6ccc40-de49-4cd2-99e3-7a9f7f9964a4", "comment": "Malware payload (AgentTesla)", "value": "61fe92bd8ec9b76e68bdc0d4e6a6830d19bcdbf8fc2b1f8f5ec5fe705be72915", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371477, "uuid": "870eac31-88cb-453c-aa35-5c0cec07be30", "comment": "Malware payload (AgentTesla)", "value": "a784daf7af9c98924d561f77f206089ff2c3ffdb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371477, "uuid": "24cb1153-3d17-4331-86c4-3cab0df9a288", "comment": "Malware payload (AgentTesla)", "value": "7664cf9d467d9b1c4bac83727e19a8b1cab8cb1c85015efb0cc72b392226be9b8b56e907d6f13061a4a82a2e70ff23a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371477, "uuid": "03a04188-cc1c-4530-a7b3-e42e9f8f6913", "value": "T1D63512446315E222C58427392AF0F77913FD5EAEB402D7538FE9ACEFB872B021D44692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371477, "uuid": "746337a3-3cda-47d1-89ae-59bb6a27ecf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371477, "uuid": "5a034655-36a1-4540-9b07-cfd86cb2a033", "value": "24576:aV/hhiEC5Qni7GeXdT2K6ke/UtsaKQAiR/5q7B6ufgPZ:YiJ7Gep2Kw/UuaKQAi/y6ufg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371477, "uuid": "a8a61a39-518b-4a2a-bb8d-dfb5bd3a1420", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371477, "uuid": "5425b260-edf9-4b9d-9565-4512e6095586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371477, "uuid": "2fae8ba3-aaa4-4fea-9b43-a4a5406a3020", "value": "61fe92bd8ec9b76e68bdc0d4e6a6830d19bcdbf8fc2b1f8f5ec5fe705be72915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe6865a-9473-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786336102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336102, "uuid": "3ec63326-69c9-440b-a4c7-a5983246e138", "comment": "Malware payload", "value": "2c20efb20fdc478615c8ecde9ff16258", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336102, "uuid": "d2cea5e6-0e6d-40ad-8025-ee0c28baa38c", "comment": "Malware payload", "value": "620d0e9ce67dc78101a7f84aae27e3ddb1054c7a88d216242bb23e1eab6110a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336102, "uuid": "97df52e8-7efa-4755-bef1-e11e13bbc518", "comment": "Malware payload", "value": "69ee463eaf33122c7f5182d8acf6f13c85814a48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786336102, "uuid": "7fa0f49d-53d2-467d-ad86-8d200a5002cf", "comment": "Malware payload", "value": "98ca6112a76486f8f89d49d66710790afa6bc9ee841a154833da040fbf3a594def6bf249428fe58e44028d35598d809e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336102, "uuid": "b5faa49f-c3b4-4155-9914-c898ebba109a", "value": "T14223C31BBAA3B47CC24BD0B46A9AD5F1B93178B402213D3FA3C5FA312D35D512A54E72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336102, "uuid": "4408e6a6-1490-4283-84ac-f73be3df0672", "value": "768:h6Q8n9I+h+ZqquVAy5pY38uCfGbGxgXw3wTXlljpPJ:kQ8n9ICpAy368QGxgXw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786336102, "uuid": "c04c4a4e-62a3-4e74-bb4e-b29bee2465bf", "value": 46160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786336102, "uuid": "4c16d3ae-de4c-4b30-9db5-030ec22cb645", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786336102, "uuid": "6aa57088-52af-4cd2-b905-a068e8e680fe", "value": "620d0e9ce67dc78101a7f84aae27e3ddb1054c7a88d216242bb23e1eab6110a2.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e65cd76-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371969, "uuid": "2581b478-cd38-414f-888e-78216e776d36", "comment": "Malware payload (AgentTesla)", "value": "6a753d53eebace9181283bad8a6d02e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371969, "uuid": "ce2d3b27-7ec1-472b-a724-18721ae98063", "comment": "Malware payload (AgentTesla)", "value": "621242d555173821bb991562ad5292cc0ede93fbbe860fbb7fd1208ecf4a0ece", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371969, "uuid": "867c4e8a-a68f-41db-bba5-c1c5019a4c36", "comment": "Malware payload (AgentTesla)", "value": "e821b347fea0ea7eccdff896aac9412148b79e16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371969, "uuid": "348ad17f-8b77-4713-b951-126bda34c235", "comment": "Malware payload (AgentTesla)", "value": "e4a7164e4a8576aa776fc8bded26def5ec5c80de05556efb6600449ede79840bffe883931ae3eda4cee8cbf2a44f1517", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371969, "uuid": "f823c32f-00a9-4f46-a2e5-738256a03705", "value": "T1FE3501259DC72E55C73D0F7CC3A204A423F0C4074265DBAA3EFCC6F95EE2A8A6927552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371969, "uuid": "a71185fb-57b9-4d1b-b8c9-f59810c1b656", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371969, "uuid": "cdfc65f3-a721-4d85-8991-6fc0201575c9", "value": "24576:sxd8QHXHUh0ONLjroY0GSa56HzLyEw2GClGSL:s7rH/O9HnSPHzuEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371969, "uuid": "42b2ccbb-7f8c-43bc-9cdf-e332f8d488be", "value": 1134080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371969, "uuid": "a69007db-0d49-4184-bb28-0e1f2dda7764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371969, "uuid": "9f82464d-a2eb-42e9-8f5a-4b402e330e9b", "value": "621242d555173821bb991562ad5292cc0ede93fbbe860fbb7fd1208ecf4a0ece", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91fe01a1-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369022, "uuid": "f8738ac6-d5a2-400a-ab13-ddd2596012dc", "comment": "Malware payload (Formbook)", "value": "ebe931a98bb6edeff27bd1d7ea96026c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369022, "uuid": "b69f35bc-b417-4c91-8173-dc43a4761f56", "comment": "Malware payload (Formbook)", "value": "6239a0af058f1d51a3fb2b85f8bd84a9ff60e97dfae1f9f54311e009a612545f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369022, "uuid": "164f43f3-83ff-4111-9f44-3d8e067cf734", "comment": "Malware payload (Formbook)", "value": "90262db570b97268cd562cce63a6032db523a0ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369022, "uuid": "524231af-0698-4188-9721-772a47efa744", "comment": "Malware payload (Formbook)", "value": "298086b2374be8bca27dc999eda179ac11346b6d830e01c4db91a2c8d73f6428054b424d65b4a29ce49155de19887e2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369022, "uuid": "46b28705-39a9-498e-b7ea-a16815d33c40", "value": "T1663501292659CE03C4B70BF45832D2F49B786E98E912D20B9FD93EDFB9353825604793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369022, "uuid": "9989203c-7d7f-4ea0-bc09-27480cc5689a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369022, "uuid": "25d5490a-9b12-46e3-9ac7-1e8ed1f59b0a", "value": "24576:La6UwB+UQ0N7h6EYLUsaYSBu0Ae1nKTdMAIAx3gdo8ME:La69BXwEYIov52nixy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369022, "uuid": "b92b4c92-966c-4d02-8190-010c994fad03", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369022, "uuid": "c66071ed-0f57-4380-9475-a1c9b3a15696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369022, "uuid": "1eb87e3c-ac3d-49cb-957f-87689a09eb56", "value": "6239a0af058f1d51a3fb2b85f8bd84a9ff60e97dfae1f9f54311e009a612545f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bd90e7-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786371570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371570, "uuid": "4de6c22e-7d22-460c-9198-ca3972dbd0cd", "comment": "Malware payload (AsyncRAT)", "value": "f27530384b8f4bf044541ab70b1cd483", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371570, "uuid": "cd522553-90a2-49a4-abe2-e7fa8d9ef5fe", "comment": "Malware payload (AsyncRAT)", "value": "623ee76c1d4afb67dffc3680332759a338ca7a171e3d979a01fe0a48bf3034a8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371570, "uuid": "929a69f4-f75b-424c-9fce-721c952977d4", "comment": "Malware payload (AsyncRAT)", "value": "8b0e925ae72d5615856787cbf7affebbb8e67d78", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371570, "uuid": "865ff5a1-ed1e-4959-8ba8-f8819006a748", "comment": "Malware payload (AsyncRAT)", "value": "4bd1b5c2f1d2d0fadd92b3405d2ecdab2bb2755fe9f6c655a1c079ba38c61e6353fd425e017536f287b5f302f59e7f0e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371570, "uuid": "e8d951bc-30dd-4605-94e3-fdb5f139ae60", "value": "T1BDF412245669EA13C8502B791F60F3B423BD6DEAF811D72AAFD9BCDF7C36A044910153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371570, "uuid": "751b7017-f2e1-4eca-9ea6-f1fe54df89e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371570, "uuid": "0b585c74-4e9c-4807-9539-fd171e859660", "value": "12288:JTBy1lJdbbypwnbZw1yvXxB1dhWuDxOWulsMoEWV5XVkdt17uiu9najfSL7yy:JTB6pyMlX/1ds2kZ0XVkdt0iYn17y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371570, "uuid": "8d2b9704-1d5e-4bd2-80b1-57ce92e433b1", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371570, "uuid": "c2ba6229-8092-4e0f-a96c-c871c4423263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371570, "uuid": "8c8adb72-0dd3-4ef6-aa5d-2fd5bc2992e8", "value": "623ee76c1d4afb67dffc3680332759a338ca7a171e3d979a01fe0a48bf3034a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32914610-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786373587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373587, "uuid": "a0bf6ad2-8fa6-488a-add6-f649a13f67a3", "comment": "Malware payload (njrat)", "value": "d0fdf5df46f7627820082c8ff8da70fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373587, "uuid": "c6163049-3242-4939-9e29-b08bf5aac2d3", "comment": "Malware payload (njrat)", "value": "626c7070556088e0c2b6d473707d7763716d49472e0378b4a1682732f917893d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373587, "uuid": "1c6ad65f-bafc-40f9-acb2-0879f16aaa71", "comment": "Malware payload (njrat)", "value": "6d16dcb0186ef1c562c824da4e43ab41ff3d414f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373587, "uuid": "46065dcc-1b2e-4af2-bb83-5a7211cc44c8", "comment": "Malware payload (njrat)", "value": "fbfdae5afc1ebcc20c57f9a96d50f3011269d1dbdc5c1eec74e64ccbbdd5a0e18fe6e1acc168360c6ac697e378132643", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373587, "uuid": "e06468a9-37c7-4a74-bd25-629a16ee26b8", "value": "T1FC15F1191A278602E9B1AFF01E71F0B0577A6CEAA535D60A4FDA0CEBB0777507C1532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373587, "uuid": "271fed99-1673-40b5-8542-9dc6d92d51cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373587, "uuid": "dfd08f6b-8091-4794-94dc-e09fab8ad93d", "value": "24576:UQYJTnEq5VYx9MUiSlCwJcTp/XJ2FfLRs:UQY+qWiQhZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373587, "uuid": "bdc69559-6e47-4b8b-8d2c-61a2bff4848c", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373587, "uuid": "367ae246-3cf2-493c-aedc-ebc2e6d02219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373587, "uuid": "b975a6fe-e41b-42f2-8ae1-7469c1134ef6", "value": "626c7070556088e0c2b6d473707d7763716d49472e0378b4a1682732f917893d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5788fdcd-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373649, "uuid": "a143091d-0f2f-45e4-a21b-6d39781f0f90", "comment": "Malware payload (AgentTesla)", "value": "a815abf64b56e6f733e22b42db19e853", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373649, "uuid": "43e60661-f4a2-47ac-bbf8-1a6ca25fe04d", "comment": "Malware payload (AgentTesla)", "value": "629fb8f53a18bd7ce5d16d3bb22f97e41d21301b25d58a7e505f8fc1ca55c907", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373649, "uuid": "667bc6cd-42d2-412e-a6cc-dd521668fce4", "comment": "Malware payload (AgentTesla)", "value": "2530b59494d5abf6a517c0594661783fda739c43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373649, "uuid": "60af439f-dfc8-4881-8758-17acf7494e9a", "comment": "Malware payload (AgentTesla)", "value": "ca741cf8e829debed94e7dfe353f77d04b0256f96064f11a93d79402d7dff87bdd72947986f01aa89075e5cfc58e1ff4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373649, "uuid": "78d294e7-0348-46ba-803f-dbd7e3e2a597", "value": "T18B25012815278A03E8B26FB04D31F1B16B796DEAF631D20A4FEA1CEB74677107D04766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373649, "uuid": "99a17782-c03c-4d74-bf53-147159a6d299", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373649, "uuid": "0179e80e-73bb-4508-82ed-743cffbb73dd", "value": "24576:Jnz/kr1o30Jd4XKLTM9s0GucLla4SVfn6jc:Jnz/G1K0JdC7s0bcxazZnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373649, "uuid": "dede1bd3-0fa0-4f18-ab7d-33fb63e0fc5f", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373649, "uuid": "0a9eab23-c688-4d56-a006-2f6c5e6736b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373649, "uuid": "dabae7fa-5ae2-48d9-bd2d-d995af07d733", "value": "629fb8f53a18bd7ce5d16d3bb22f97e41d21301b25d58a7e505f8fc1ca55c907", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a62530d-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340207, "uuid": "0cb7fdec-dd86-4bd3-958b-f2d412a48969", "comment": "Malware payload (Mirai)", "value": "db10ae26b4119d92c4334cb6c75849db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340207, "uuid": "929dad9e-badd-469c-9abe-923bdf0ddd97", "comment": "Malware payload (Mirai)", "value": "62cbf1bd12fc71ba0423cc93d3486237ea84268ee702b54d160c9bb047b4d97e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340207, "uuid": "e62dade4-ddc9-4d4c-8ed7-0748ea25f21f", "comment": "Malware payload (Mirai)", "value": "3fbb69b2211da9f5a886a061f55664f67a388079", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340207, "uuid": "b126cb78-185d-473f-ada2-3f694068a42b", "comment": "Malware payload (Mirai)", "value": "820f047c728e0f969ec8f83428d9f239515acc9f4310ceafb3fdea93e38fcce6729c10242b42475bbf9399994749134c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340207, "uuid": "2ee845ac-3c29-4f2b-85ce-0ad423fda603", "value": "T15074FB88B5F2E2CAD1D4EAB5E319784D3B630736B1D73145A50EEA3312EF15809BDE60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340207, "uuid": "60c061fe-0b3b-42f6-9094-7076de5d0b94", "value": "6144:8a9ya95a9SjkyWqsMYhsrwfjJjckH/dnuVOVPQYC+bjTTiztp:8a9ya95a9SjkDBjJ4klKOpc+bjTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340207, "uuid": "9135da75-bf13-4a51-bc8a-fd7868efe098", "value": 360944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340207, "uuid": "5512a180-ceef-4d89-bab6-3def17795276", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340207, "uuid": "abb9eeb6-06f4-4ad3-bc28-4bed1013f5aa", "value": "pid.ar7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f718d28-94f7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786392587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392587, "uuid": "9572ca4d-080d-4d7c-bd01-1d0983fb1ea0", "comment": "Malware payload", "value": "e6419b2c12c29b75847a945ed1104b2d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392587, "uuid": "45892781-2aa2-4b31-970f-6cd5255241b1", "comment": "Malware payload", "value": "62e99fe42356690d0d6f03e331b13f213b07d1e450e6ee9526d0bc0500905bd6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392587, "uuid": "937f2b64-115a-41d9-95e4-42e74249f47e", "comment": "Malware payload", "value": "1c478433bb36f720751321d86f91234f42eec13d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786392587, "uuid": "9917ef2d-45db-43f1-8765-d056b88f8b79", "comment": "Malware payload", "value": "bd3ef52b48e845639c1620b513c894d67fc344eff7f5277cbee838b1d3f4dadf1f11ba8872a84da18f5e5d0298cbafb4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392587, "uuid": "a4ebbe2e-18be-48e8-9aa9-7fceecca25ab", "value": "T18B01CECDD130951050AAE86C32DB6064F821C3C7194B4F76BFACA47E9BDCE04B026FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392587, "uuid": "87f1d550-0b46-45f6-abcf-df6731891592", "value": "24:kXCKysE2hi0ziQvZohauXIvEqbTflB1zeX:e9Qp+MsmIvEGTj1zeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786392587, "uuid": "12588c37-382a-4cdb-89dd-3037db223b75", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786392587, "uuid": "22996c32-49b7-46ac-9382-0fa41322020b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786392587, "uuid": "7997b531-b551-4275-b83a-19d660d8d138", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13144b06-9463-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786328866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328866, "uuid": "a866ab40-ef52-404a-b799-aa1ef2df4eb3", "comment": "Malware payload", "value": "3d62a8a38ae1d5023c0f7647784a1df1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328866, "uuid": "67bf106e-9f17-4d41-9c19-893e9633a627", "comment": "Malware payload", "value": "62f058d6f04af72a0dca6cb973fb9b7b6b75aa6162d769abf9bca946fcaedeb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328866, "uuid": "acc553e9-9821-41a6-9a6c-5f83c6febb7a", "comment": "Malware payload", "value": "87075f7aedda63b6d6974ecb14cf8536688ff208", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328866, "uuid": "9fd1bd0d-8335-428f-af3a-037515ec0976", "comment": "Malware payload", "value": "bf40410fc15bcd8eea5e4384cb7ec25550414598e0a7aac3072247675eda3321d4cbda0f85235f4d3de15ec461447fd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328866, "uuid": "8764f3c2-07d9-48ec-bb5c-c8667206a8ce", "value": "T135133BBEDF0E3941E3D4E338EB550BE1603F7924D39680B67E42718DC4E99DD89A2246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328866, "uuid": "9faa634d-6a07-46dd-a9d9-617f03bb9ff7", "value": "768:QVE3rvrM5WPmE9CTjPavELfT/MVir4FyGZFLawW0KrT3C2hiWW:WEbzM5ZRPP7YYs3ZEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328866, "uuid": "ed6ff084-1bac-4d51-a4e4-69975592520b", "value": 42048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328866, "uuid": "e973ee0c-e72e-4579-9282-30f2cba6a11b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328866, "uuid": "79b22199-d0c1-4096-87b7-4aa9ae138719", "value": "main.aarch64be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8c4fed-949d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786353816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353816, "uuid": "61fa2321-1213-45e1-a2cd-7c32ab38b79c", "comment": "Malware payload (Mirai)", "value": "4c30f86beeed0e46c6d6d398973d2ef6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353816, "uuid": "18d748a3-c2cc-4ddd-af64-f3c8e5e3a1ab", "comment": "Malware payload (Mirai)", "value": "62fb0f9252f8009b02e0bb658210beb9b01c6fe4c0a07ad3f06244a0f6190c42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353816, "uuid": "614d3151-50cc-419b-88cb-0a9424ee57c1", "comment": "Malware payload (Mirai)", "value": "20856af30673eb39538326309e09f17085a6f30a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353816, "uuid": "b8552624-fcad-4535-a8af-4180847065a8", "comment": "Malware payload (Mirai)", "value": "0b066917d45f976564ffdb38b17ac097b21ead033ed85cf71446213af7526d410cbc19a30f52b6639b2d78d6e4e1bf58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353816, "uuid": "527df952-209f-4be8-b0c5-b9c05da83938", "value": "T11D34A71A3A12EFBFF568863107F38A7097D521963AE19346F26CD71C1E2028D685F7E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353816, "uuid": "c6db8fde-6e2c-4c4a-9238-8a8a47424da7", "value": "6144:sx7f5flfnJXQhAoNlaDm7zvnreG3Ai/a9vNYzpWe:ubfnJSgDizvnreG3Ai/a9vNYzpWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353816, "uuid": "677149f9-3c4e-49cd-b714-c1972244c2bf", "value": 238353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353816, "uuid": "c0b6e511-20c4-45f4-9c85-47f770c68c77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353816, "uuid": "0535be1b-486e-482d-96ea-ecaaf4c0d51e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970fb65d-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkCloud)", "timestamp": 1786373326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373326, "uuid": "f1e2ee83-5c53-47c2-a603-163142b470a6", "comment": "Malware payload (DarkCloud)", "value": "6aa4e8829156aa52686ba3804b533738", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373326, "uuid": "59b47105-87f1-46ef-8db8-59b832a26914", "comment": "Malware payload (DarkCloud)", "value": "63363200a03e8ef1c2790eed53def864d750d6adf08779186770507473b7a1a0", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373326, "uuid": "a4e035e2-bac8-453c-ac82-6c0f520f71ce", "comment": "Malware payload (DarkCloud)", "value": "e312d46625f527fa03deceaa5e16e0cbf0c7dadc", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373326, "uuid": "605a4ed5-2c83-4a5e-9ca9-d2956bed2b29", "comment": "Malware payload (DarkCloud)", "value": "d72e821cf9d223be087d261687eac0a91aa115fd527f2c0d6dc3a55af7e52abfb216f9954a18ee22ef0b221eeb189aee", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373326, "uuid": "ecd490e1-27b2-4dc0-bde1-b746ea9a9dd3", "value": "T19D45236AC156C013D18907FE6E62C0B123B92ECC2511FA5BDBECBC8BBC6175B6914B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373326, "uuid": "40f372a1-c888-47df-96de-1e917055123f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373326, "uuid": "86dc9373-e7e4-4abe-9f40-901facf559d1", "value": "24576:Z3HBYg+gnzPjsNFBMyax3jruRRBXZUeVS8LxpMW3Xk4Xn+JTDfcHBY1HBY:JaLEYPB+3mRRB1VS8LxpR31X+pDwaRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373326, "uuid": "b40ad61b-69a7-4352-b240-df4bf2408d74", "value": 1266688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373326, "uuid": "73071058-0ed2-44c8-b891-4a31d9faa171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373326, "uuid": "70a80550-6208-4c4f-a8ca-447d00589577", "value": "63363200a03e8ef1c2790eed53def864d750d6adf08779186770507473b7a1a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0812eb67-94dc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786380817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380817, "uuid": "abb3d343-005b-4cc8-b0f6-25ec0ca0d7e3", "comment": "Malware payload", "value": "9a3aabe8657b2f87da866fa6ac24746e", "object_relation": "md5", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380817, "uuid": "800e597a-f315-45fb-bc6d-079efa85887c", "comment": "Malware payload", "value": "639430a33c0ecdf5a134501788a3a40f065ae4232efc66e1b82eca2b355e0606", "object_relation": "sha256", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380817, "uuid": "cb1b000e-0ee3-4eb7-adb5-213e11815ab0", "comment": "Malware payload", "value": "c8af31d99e4f1905af7ede0840ed50abe762b807", "object_relation": "sha1", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380817, "uuid": "f318faab-ee80-41ee-a784-f71053d7b367", "comment": "Malware payload", "value": "5b620fbdff9a1947f924168d6715afb5cb2ce71686dfe5ee2e1adb7ace0f2f991dca6947ba444a071cfa843a635d3f56", "object_relation": "sha3-384", "Tag": [ { "name": "207-174-0-143", "colour": "#FC6F54", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "pkg", "colour": "#01B8C7", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380817, "uuid": "afe036c0-db35-4c77-b955-6c9e8d2dd167", "value": "T17397334860F96E18C15FB372CE533B5D6BFF1666A83BDE42FAE3A18F42151C9821508D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380817, "uuid": "6058500f-9d85-4a10-a624-f91a055f89a2", "value": "786432:0l0ZmMQuvvHHb6daRumWzPJ0pIx/7ak1PHftafaemq6zK1:w04JyHHSmWbJNBIj16za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786380817, "uuid": "eb5aaf7d-4755-40da-b1d7-cb927e49acf0", "value": 39605378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786380817, "uuid": "0cdd98cf-224d-4c50-861c-32fa6b38f44b", "value": "application/x-xar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380817, "uuid": "d477418a-3e58-4e9f-9532-edc39dc32dac", "value": "Zoomupdateinstaller.pkg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6a938f-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373231, "uuid": "1dbdcb18-e98b-42e0-8a41-f413aa5ae580", "comment": "Malware payload (AgentTesla)", "value": "d0729d1aee5476642dad75160a34e6d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373231, "uuid": "23e1673c-0f5b-4405-bc46-d6178bc7a972", "comment": "Malware payload (AgentTesla)", "value": "63aa8d418861ddd8922cc8bd25e808ef7b251f35f2605cfd64ba0d2efdb6b0dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373231, "uuid": "bc214c26-b268-4ef2-b467-aac212706fd2", "comment": "Malware payload (AgentTesla)", "value": "d43bb103e8669d5ea34461c87df64264d357e416", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373231, "uuid": "034293f7-ee40-4fc2-8b83-e6c9b34134b5", "comment": "Malware payload (AgentTesla)", "value": "b1677a32173ba343e1467141d6afd7505f71eaca02667b50f73112a37c9e997357f4a9557bf7e476c63368baa965ed1f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373231, "uuid": "2e26cc72-400c-430d-88fb-140a9994fdb6", "value": "T11D3512714C472659CF3E0FB8C1220A5823F0DA1753B6DBAB2EFD50B95B832C59D2B685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373231, "uuid": "66f53f20-f24d-4e10-af89-9514253a445a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373231, "uuid": "84e1c90b-4d31-4e0a-a0ef-aacf4e0a4f48", "value": "24576:rqCSTYaVWgYfTfn/oTgPQHo0+4lW+/AwyOjMG9bN5Y:rqCSTYaLoTYgoI09lWXwyONdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373231, "uuid": "e5bcc5d4-18a1-4b5a-95e6-924d9c6cefd5", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373231, "uuid": "f05346dc-1730-4a3e-a629-a66dba52b035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373231, "uuid": "a1dc3c2b-fa3a-4939-9cf4-b880f5345944", "value": "63aa8d418861ddd8922cc8bd25e808ef7b251f35f2605cfd64ba0d2efdb6b0dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73145945-945f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786327309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327309, "uuid": "cdb58ab3-acf6-4319-bb32-3fdb5f8484f5", "comment": "Malware payload (Mirai)", "value": "03429a781f706020cc1897d2ce9d17b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327309, "uuid": "b881e8ff-dc9f-42c3-a7a9-f464604ee6e0", "comment": "Malware payload (Mirai)", "value": "63c7c59b2959a3de5a5456dc53aaa41362bb7a610e8a872f15dc2b5d163902a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327309, "uuid": "ddc45abf-310d-470e-826a-9fbe39e4f5b8", "comment": "Malware payload (Mirai)", "value": "97e0e91f907ad4d7eb1756756d348184caab0710", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327309, "uuid": "36d26ec6-88ea-40ff-85a7-eefc26173552", "comment": "Malware payload (Mirai)", "value": "8288c43492ddc1568914da1d94e8e6acd74b41b253271fb4639a7e96ab06c994aa0581ab1fa4bf862456f15d3ca90577", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327309, "uuid": "75e26bf5-80ca-4a23-85e7-7168199ff237", "value": "T16B731A5AB8819B11D5C116BEFA1E518E3313077CE3DE73229E24AF20778796B0E7B506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327309, "uuid": "9eddf0d2-2dfc-4770-b55a-b4aef827b5e6", "value": "1536:SDnd7oMCDO+qrwFLtdoaTv8LQ3Mxi/1eoxZ61AJ7NG5FYNz:27hCDBDtdoaTN1eoxZ61AJxGnuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327309, "uuid": "80a0f8d7-4084-42ea-938a-2b8953fb327d", "value": 75348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327309, "uuid": "e01c534e-f420-436d-9b85-ecb8c125b8d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327309, "uuid": "76a629cb-6805-4918-bcfe-5b17644ec44d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a448fe5a-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372060, "uuid": "20e82924-e057-44cf-8e8a-138288d04022", "comment": "Malware payload (Formbook)", "value": "5cf9be7dbed2c44e4d32d56ed880eaf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372060, "uuid": "419e32da-c1fb-4449-a55f-46ab457a149f", "comment": "Malware payload (Formbook)", "value": "64416ba83eea79f37407e6af107cf4b5b40b0a2994910e37e60a556b0b156476", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372060, "uuid": "3fc78d26-efa6-4a08-a808-2a928355ce83", "comment": "Malware payload (Formbook)", "value": "8ee0eae42a3de2f34753136214542b3d75fcf6b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372060, "uuid": "b5542632-f9ac-48fc-814d-24d41767aebc", "comment": "Malware payload (Formbook)", "value": "57634e23bbfc11277913aecb03c80f20bc456665b545d894f6f976cb66de8877bdebc58b75e5c1cb468f13332be57389", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372060, "uuid": "ea88502a-cd31-485d-a240-16c6c9777789", "value": "T1EA252314DA96EE29C39507B40AF5F23E13B42D5ED522C367CECADCDB7099B4420987B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372060, "uuid": "6cf7c5ab-8d71-4cfa-b18a-d69035dfe4fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372060, "uuid": "242b465e-1132-4e5e-b89f-0051592246f7", "value": "24576:Ej/Og3m8p4va8BdK0zmvT0jlHXGrAQT6iGtP2Nx37UsuGUH16+:+Pvp4va8GVvTwl3GrXPGtP2N9Ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372060, "uuid": "aec60b62-3be9-4b2e-8139-a5dcf9af933a", "value": 995840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372060, "uuid": "5a494f2a-fac4-4986-920d-66e7e292e8c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372060, "uuid": "1d186831-39bb-4e13-9375-f4b9aad719f7", "value": "64416ba83eea79f37407e6af107cf4b5b40b0a2994910e37e60a556b0b156476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14a6378-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368189, "uuid": "32a8417c-ede2-4796-b937-9b1eac6c0b7e", "comment": "Malware payload (Vidar)", "value": "4fe7875b4226cbe87dff3d5fa52e689f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368189, "uuid": "6f69324c-a3f0-4f90-a8da-4d26a47b8170", "comment": "Malware payload (Vidar)", "value": "649d23fa6cea42e2fd41cde64c765db038abbe9323c53fc33a1067a6f3895f88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368189, "uuid": "e4dd24d4-0fe5-4ec7-8a0c-80bb37facbd1", "comment": "Malware payload (Vidar)", "value": "1fa128a9cc51f2b810c492651b66fdabe3457bd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368189, "uuid": "71c024bd-b278-43e9-9b50-94bb347fe1d6", "comment": "Malware payload (Vidar)", "value": "7b8225bd759482b172a4aea158883da7658347849e5f5745d3e20fd14a7200d0f6d6943a6149918a39ca020d88f363d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368189, "uuid": "51e8a068-7094-4ff3-9d3f-0715245c23a2", "value": "T1F052E789B28770F5C0AAC37CDBC7167A8A627084032D9EFF9BDDC1C829D251139B45A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368189, "uuid": "8c7532cf-fc5d-4443-a915-017b963fc16f", "value": "0c46c7fafa1efaedd2bd2c7fa5773426", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368189, "uuid": "f828b4b2-9a12-4f29-9c4b-9cbb6566f355", "value": "192:OYOoSJNAkin7nNIzzJu2gvxIgb7kmOstrnQnyh7s0wB13TyU3VR26zatsDW:OY/SPin7n8YxIgbImxpkZ3TrlZzysD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368189, "uuid": "88921dcf-e2d2-4cdd-a58f-689714bd5923", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368189, "uuid": "c6fe2dc4-241f-4ce7-94de-da1fe4f2cf9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368189, "uuid": "6bb4d8d5-5df2-4a82-9264-98dcaa6b6d97", "value": "649d23fa6cea42e2fd41cde64c765db038abbe9323c53fc33a1067a6f3895f88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc4d296-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372423, "uuid": "e2241a8f-4f2c-455f-bbe4-450d9edac4fa", "comment": "Malware payload (Formbook)", "value": "f978f659e30cf9215d5c70184a72f791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372423, "uuid": "5be0972e-fa10-4541-9746-3d3d3d14ad4f", "comment": "Malware payload (Formbook)", "value": "64ef4bfe4937ea47d418c2a0797b324bb0beba076700bfc5ec6274c8b9e757a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372423, "uuid": "1c92407c-defd-4bd4-8238-21ee7c29a29f", "comment": "Malware payload (Formbook)", "value": "0fabbdd4fb8663fc57d34bdfbaa98a2caa739204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372423, "uuid": "ed5722e2-ae90-48c1-9852-6854474ac110", "comment": "Malware payload (Formbook)", "value": "1093955b8420e82dc4fbff7d430b47a59b905f09a1a8a5218424767afe7098dc68ddb0df56a24c56b160c6ebfdd7bb62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372423, "uuid": "302c612f-3ccb-4ae2-abd4-3afd90b6c1e5", "value": "T11B45CFAC7211B9DEC457C97289649C34A6116C6A830BD203A09B3DEFBA3D697DF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372423, "uuid": "c128f92a-1b29-4ba7-826b-15a59b2b631f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372423, "uuid": "94b0db41-5fd4-4137-80e8-095b6a79f141", "value": "24576:pjvj/Og3lUt2B9gjk3YIvtBWMgEk9XupQYjUsADpERTRSfs:F7PmgB9gkBtlC9X5RDuRVSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372423, "uuid": "2ec0186c-eab1-446b-89fb-abac9cf6efe2", "value": 1252352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372423, "uuid": "edcd02ee-7b67-43b9-a8f1-bc02720a51fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372423, "uuid": "1f9f5cc5-ee81-44a1-a9f9-112872c2d841", "value": "64ef4bfe4937ea47d418c2a0797b324bb0beba076700bfc5ec6274c8b9e757a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfc8eca-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1786373713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373713, "uuid": "b4605d94-ab93-4cfe-83ab-d24c712af9a6", "comment": "Malware payload (DonutLoader)", "value": "4f5443d85b42b62f03fc6a7655a398af", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373713, "uuid": "4e061709-a52e-4f08-a93f-740d20ee8d22", "comment": "Malware payload (DonutLoader)", "value": "6521394d5adbc47d59c42a22199a9ffc9b4192a3d2eea10c716829255efd7ef9", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373713, "uuid": "9c75e0b1-8167-4e47-816b-848e2d479685", "comment": "Malware payload (DonutLoader)", "value": "5be0a231ed0c7739eda4c7b2340ad5a08e9bcf6d", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373713, "uuid": "0a0f06c2-1803-4faf-9990-09144a42a3d6", "comment": "Malware payload (DonutLoader)", "value": "465a1ec7c3cff3674f41a8be2160455c1ca01850039619f4ff3746b6f2778da165cae29fca6104ad16e9e9ccf0334f02", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373713, "uuid": "0d601588-7198-48ac-a3b1-a37afe4c9b36", "value": "T125A423218F581EFAC6F5C67719BE4E8563323E25B0D8D0EE029E111B01F6E513C6EEA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373713, "uuid": "4dcbaf61-eeef-4ebe-a515-37988c02f402", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373713, "uuid": "3a9cf78a-afff-4440-beb6-444304b7f8f8", "value": "12288:RW5sSNQXHgTwRPqGNPWrMDdR+XGkpx7GqMHLa:RW5sSNKATsjWr8X+XXY9HL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373713, "uuid": "af15f538-53c4-4e33-b024-ff22e7f0bdb5", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373713, "uuid": "49520bfd-4719-494b-a225-4c402b87d0d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373713, "uuid": "cdc1dc4b-1e8a-49d6-b415-67bd5d96d546", "value": "6521394d5adbc47d59c42a22199a9ffc9b4192a3d2eea10c716829255efd7ef9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d9338c-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786373129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373129, "uuid": "e7f91417-d23f-4ed9-b69f-9b8676c0226b", "comment": "Malware payload (GuLoader)", "value": "851beb1657e7ad7797d8d90c07b449ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373129, "uuid": "a304dfa1-c401-4c33-a7e5-3f459c3dea8e", "comment": "Malware payload (GuLoader)", "value": "6522a9aa201edfd5449037d4576bab69c83abeeb2a3a73f06e91682c50051dc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373129, "uuid": "b4195b3a-866e-4ea4-b46d-6229be1fb92d", "comment": "Malware payload (GuLoader)", "value": "0c9b38929895d235395dc9f0846ef40e2def4fae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373129, "uuid": "57fae9cd-6057-4cf0-986e-43fdeef17f5d", "comment": "Malware payload (GuLoader)", "value": "9d6829283a44dc038dee72c44794b553039a2b6b73e42d72d98c00cdeb61e3921ee0e3d17f8d6e6fcf52cd691227cfe8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373129, "uuid": "fd3311b1-da12-4b3c-bae1-07cdf5c12299", "value": "T182C4E0C5BD109076C4AC0732E06EA66F196BFF2D46345A4322ACFF1B7A7D702851993E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373129, "uuid": "c4fa9917-eb1d-41fe-9ed5-021fede88de1", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373129, "uuid": "5888beea-2926-42f2-b61e-9a020e798524", "value": "12288:JXctpOFtZmB+2ufn/JmaKQ4ngNNvHEqho:JXYUFvN2qRm9WE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373129, "uuid": "d3e28d5c-7ffa-4268-8cb2-41237caeb4ef", "value": 583704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373129, "uuid": "4fce5d00-86df-4073-b149-b1007d9ad6e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373129, "uuid": "14595356-0b5f-4b70-a071-2c36db13a890", "value": "6522a9aa201edfd5449037d4576bab69c83abeeb2a3a73f06e91682c50051dc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f639a3b-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340054, "uuid": "6e15e2a1-d5dc-4d0f-b405-b9cb9f088019", "comment": "Malware payload (Mirai)", "value": "6857952d8149484cc0e9860f8d72b266", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340054, "uuid": "6fa05dd2-6933-4833-a110-eda0f93c1599", "comment": "Malware payload (Mirai)", "value": "65a0fa3217889f845c9700d8e4f9faf212a32299c19183446243a7790c330d46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340054, "uuid": "e146f195-70e8-412d-9502-be1917d8e969", "comment": "Malware payload (Mirai)", "value": "71d0275c71ea95838b3c70d14b4a653cca8f9016", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340054, "uuid": "83945659-391e-4563-aa9a-7e449681bfb6", "comment": "Malware payload (Mirai)", "value": "c1d119bb3ceaefbca8269d5d04998ec86dd5ab13b355550845dfa1310616f0df5c5f2e29add06e3f470a93be52e426fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340054, "uuid": "564d6c8b-ed6e-4dff-a85c-250e78236584", "value": "T14974FA8451F1E6DAD15CBD726332BF1A2F77093670D33145A09AE6BF32AF18449AC9B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340054, "uuid": "f1254f7d-381d-4c57-a44f-0d253627c31f", "value": "6144:VOLaT9J/MTI1HiBRLKrbAGBeOg+6c6//h8OQJWLJWfFGUf5mS:VOLaT9YaQGkeU/KzJWLJWfFn5mS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340054, "uuid": "934f7fb8-b94b-4e10-966f-d9d0d098d4a9", "value": 362252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340054, "uuid": "a7c849c6-0de6-4560-9fdd-5cd35075ff24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340054, "uuid": "0cd74e88-8100-47ff-ab6c-272ea69becc1", "value": "pid.armeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6722bd8a-94d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786375822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375822, "uuid": "8dd2e1f5-0010-4316-9b8f-a942a48bd9e5", "comment": "Malware payload (Formbook)", "value": "b168b4d24d692c1b8e7567f446dceea4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375822, "uuid": "ff9fb92c-c8ec-4beb-8f8f-fdb301f9564b", "comment": "Malware payload (Formbook)", "value": "65dbe21962f1ecd850b8b0cabcc0f1a420d92dbf006ba94fdeda3e07472230bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375822, "uuid": "7e301d3f-cc5e-4627-af01-820185a0efd0", "comment": "Malware payload (Formbook)", "value": "64ad04d7edc49ae3edcdebbdba8792dedd1ae6da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786375822, "uuid": "83d0494c-3b24-4be0-8cf1-21e6cafaa2dd", "comment": "Malware payload (Formbook)", "value": "3850df5ef50d2337bba49481e96471571831887dbc8dd9a647edff1728718db4d8a5e756311514c2aa775ad4819744b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786375822, "uuid": "995a4051-06c0-41c1-99f0-1ae1f9142c46", "value": "T1CBE4AFB976142CE6E67F577BCD97ADD803B636228AC799CD40A4B7C30D63361EE02805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786375822, "uuid": "ab60e9d4-4aab-4e52-9688-9f8f39b1a42e", "value": "2d3437c41fae09bc2c594d490e658972", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786375822, "uuid": "6c96e50b-306d-40d5-be2b-1b16aecf6725", "value": "12288:Zh8cX7I7j2arXmBU2EyGXj56tEWB/ZTcRFN4kO269NVZhBZafkp2sK:Z/0Oc2S29GXj56tzBZT4FY2eVZT08BK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786375822, "uuid": "1a76b90c-5449-48b9-8524-1bd20831c3b7", "value": 709554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786375822, "uuid": "b6dcad78-e1b0-4d96-b0a4-628d898724f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786375822, "uuid": "021317cd-9c2e-498e-a0e5-0461bbf70a36", "value": "SecuriteInfo.com.Variant.Yogi.44771.23588.21930", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec5116a-9488-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786344858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344858, "uuid": "3a5fd375-d0ff-4982-8b03-ee548e1d1a3f", "comment": "Malware payload (Mirai)", "value": "1afd57699bb5f7382dcbdaa74c1d9a89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344858, "uuid": "eb930c30-3203-4582-a04a-20d61fb7c422", "comment": "Malware payload (Mirai)", "value": "6690d52796a3b194421dcadef0f57c71a12983c5435cf234bd2014600e4fea28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344858, "uuid": "2e817109-eb68-4a4e-9e9e-c33fdd06e0de", "comment": "Malware payload (Mirai)", "value": "acc453e53e95db62a60118089ddbbcea2541192c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344858, "uuid": "11fb2ada-e305-4de6-84a6-a45322ddc5db", "comment": "Malware payload (Mirai)", "value": "0d7c76e808f633b847df569b6a23f35d3b47d04897c5d13ac2c997e0f8010d72b72a8956cc1f2889945b4c52daba22b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344858, "uuid": "2e4d297b-f58b-4326-a982-e8ff24056945", "value": "T1A5B43B51FC519B96C6D12ABFFF5E828C732317B8E2DE31129C154B2073DB85A4E7A181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344858, "uuid": "4a88869a-2405-415a-9f8d-f878949becee", "value": "12288:8K4/cIW5LdrdREbeDhPA2QLOfV7ItO+sFgU46OTYkFbxe:8FQ5aaP0YkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786344858, "uuid": "6f066cf0-354b-4d2b-a195-e7a6ab752ea1", "value": 509664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786344858, "uuid": "ad117dc6-ae28-44bf-ac35-94dd86fd5703", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344858, "uuid": "9d7c9a88-b91b-4af6-95a6-bd30497a1856", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a816c6-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370450, "uuid": "a5db62d5-9e79-4c58-87f1-e9199b794c25", "comment": "Malware payload (Vidar)", "value": "6f36472ec84f282a78b5c0f5fbcba6ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370450, "uuid": "5f813034-9da9-4541-a8f3-063f7008de73", "comment": "Malware payload (Vidar)", "value": "6705d7f08110e194abae44d687f3fa9bc4211a941f4f5b23872426154c43b5a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370450, "uuid": "1f2b522a-aad7-4c99-af23-34ac614d5cab", "comment": "Malware payload (Vidar)", "value": "1168c742943875f7cc225a9753d4362c2303307e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370450, "uuid": "8d712de3-e43b-45a1-beb4-f29e8959efe7", "comment": "Malware payload (Vidar)", "value": "b009d35758dd888de14f682988e5f281011e9522a0e285de2508829a0d0d48fa207511d87111616433a218dc8649c4d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370450, "uuid": "a75fce17-527d-4ea8-bfb9-1ad46582409b", "value": "T1B8926245E11BAAD5C0E5C336A32A42A755F8782422365B3B5FDCBB7E4E42330E7502ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370450, "uuid": "f85e7275-0415-48ab-878f-3a06cf5601c2", "value": "e94e649e836c8320627dfabdbb134df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370450, "uuid": "e6ef8ab5-7241-4ea4-a0bb-62d3c0a2dc36", "value": "384:O0vwQ7EcVeSMbcfjQPlD6XAkZNJ5kfgBAKA6E6r3/Uq963l:l7EEet7qZNkWnA6Ehq96V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370450, "uuid": "6c0ec693-03f7-47fa-8b34-ef4b29b53142", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370450, "uuid": "4e88f408-f1b1-45ab-b6d9-de307fc851d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370450, "uuid": "e92958e5-78ad-46c2-83a4-a03eda2956a0", "value": "6705d7f08110e194abae44d687f3fa9bc4211a941f4f5b23872426154c43b5a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e6d524-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786373455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373455, "uuid": "d677289c-9ca1-4572-9b12-e72c2af65b6c", "comment": "Malware payload (PureLogsStealer)", "value": "c73f4c30e4cff955e0321b42cf401043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373455, "uuid": "4218c627-981e-487f-9a6f-2ede04955afb", "comment": "Malware payload (PureLogsStealer)", "value": "67136c1a6435b4a749258300e446d830e0bb355db942d789c482e0b7e29cb418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373455, "uuid": "dddd4f23-27ca-42c9-80f8-e35364aac2cf", "comment": "Malware payload (PureLogsStealer)", "value": "671c517ef37256425e6fd514d3cc804e443ad30d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373455, "uuid": "c17b2f71-071b-455e-83c6-cb18d656990e", "comment": "Malware payload (PureLogsStealer)", "value": "93bab17b4e8e45b74952486bc2b6b7b3b3155c0e73a46838685d8bc28aaa0a979957caa812b2be3d333ba92178184d8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373455, "uuid": "64893714-bb44-49fa-b1c3-49da7075a7bb", "value": "T13F7512040312CD46E0D687F6B9A0D27432B40DDF78E2D286DFE66FF7392978259992D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373455, "uuid": "857073a8-4c00-45a9-84c8-4b986ed6eb03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373455, "uuid": "f4052bb5-f943-4833-b207-6e0507b9fc58", "value": "24576:Xp50D3E5zFwo7ncEjYcbf+d4v83fObbEQeMy1TkFB/GbuMUsqFr5ffuXl5:Xpz7cPcbJvtEQejuB+buX7ffu15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373455, "uuid": "a6d8e3f7-b29a-4d4c-b073-857998fa23a5", "value": 1666560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373455, "uuid": "7da3f83f-8030-4012-8a61-d34e94d70ef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373455, "uuid": "4dc41636-79a2-4746-8a6f-eb679e0af6d7", "value": "67136c1a6435b4a749258300e446d830e0bb355db942d789c482e0b7e29cb418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baeb7d69-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373816, "uuid": "a4d63093-3192-43dc-b560-bdf65627c277", "comment": "Malware payload (Formbook)", "value": "3898c5efb6bba69d5605e7d4a00176b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373816, "uuid": "4786ef54-1ec6-48cd-b5ad-c766fe195b08", "comment": "Malware payload (Formbook)", "value": "673b0804edc54bb48d24da3e6fccdcf193b737bbf28ca448e215c1c63d5acb0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373816, "uuid": "f2413c4d-42c6-45fc-8a89-fe5109e1c8aa", "comment": "Malware payload (Formbook)", "value": "2b9df7d1ac163787ecc0fcd24a78560f21a7f667", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373816, "uuid": "20d4ab07-d7e0-4c42-a4ce-58788ebeb03e", "comment": "Malware payload (Formbook)", "value": "7ebd1b1c3233060ee4ad63d22307f8d04f7c7bf3c816d5a703629fa1973b1e4baa63edd852a518718211f1545d43b424", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373816, "uuid": "b7c9e1ae-8695-4667-95e2-a88cf0f1eaf1", "value": "T10B2523657AAA5B56F9772BF40E79E23017B53CCCA230C6062EED6CDFB951B040818763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373816, "uuid": "65c714d4-0229-48a6-b02b-3ef47725651a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373816, "uuid": "455af199-9ec9-4028-ad68-c0ce680b3f65", "value": "24576:XHu4Ceugd82b3ba/7Az53Zg2PKx2rkq10JUhDLN2PbQp6z:FCefd80b27o53ZgnYkq6UJJ2K6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373816, "uuid": "be56871e-2b1d-4e93-afc8-b8642262c463", "value": 1026048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373816, "uuid": "73f407af-c1d5-4534-92cd-93f36d3fea08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373816, "uuid": "e9f32748-35b0-41d1-9a33-eb0140906341", "value": "673b0804edc54bb48d24da3e6fccdcf193b737bbf28ca448e215c1c63d5acb0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800a649b-94f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786390467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390467, "uuid": "93ad055e-99e5-44d1-8158-248481a6e98b", "comment": "Malware payload (Mirai)", "value": "ebcb0c5756b6914a4510215f2233a432", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390467, "uuid": "03ed9daa-2d70-4d7b-be1a-6897434a8da6", "comment": "Malware payload (Mirai)", "value": "67521b720fb08e8af5b2696494bb62b5a76fd9f41c0d571fa733dfa0a88df42c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390467, "uuid": "d893d58f-d3e0-467a-8c3f-4943f6afe780", "comment": "Malware payload (Mirai)", "value": "fc4c848b332150a4dc53a0167eff50c48b8d071c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390467, "uuid": "b1fbc623-a451-45c5-b8da-c34d722ad8cc", "comment": "Malware payload (Mirai)", "value": "b58dcd4dc439cd034325f69fe514f7fd8bde3723e5b9b5038bde8b58fc5ef0e8688305b16a7a4e3251b98b90e7707809", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390467, "uuid": "c90b8b44-8428-4359-b0ee-f7cf7d773fe8", "value": "T131E3AFA7F74F6050C42106F81BCB5BAD2E2365018E6B9AE76C6E363E16375DF28053E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390467, "uuid": "f6c636e0-0415-4dea-99fe-400251a03294", "value": "3072:5WM93FaxuJWOjYyFTMCb8t0T09eJgVC/vhEdImHiq:5WMb8U2+7bseoeSC/pEAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786390467, "uuid": "719c98c8-2f68-4660-a8c0-eba6b72f8b5f", "value": 148948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786390467, "uuid": "299ac337-d2ea-4ea4-88e4-c7884a039d90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390467, "uuid": "4c42e045-e414-40e6-b917-dcb187fc9af2", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4210e9-94fd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395319, "uuid": "4a4103e9-1497-4220-bdd2-27e957a58cc2", "comment": "Malware payload", "value": "130665e02247028bf5fbdcb58282b08f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395319, "uuid": "c72aa872-3d07-4df7-a492-1b0b5ddee99f", "comment": "Malware payload", "value": "675259f8dde38c916f08a70d601952fe2397634a79b052f258ee97455973b824", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395319, "uuid": "08e3a734-24e1-442e-b5a9-4f1f5a5f7894", "comment": "Malware payload", "value": "c5257de0a7ba2aa0b089edd1046b4401674328fb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395319, "uuid": "cdbd8673-893b-40ea-b177-8933d36ab406", "comment": "Malware payload", "value": "59753a2a2040cdd0ae398c780e7e1ceb707754bbaaefbe3808fb8e5903209c811d7b6b75626713a85ed5b206463053ba", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395319, "uuid": "3a262afe-fcd5-4cd6-9697-4cd6ab68d13c", "value": "T1EC016FC9D27096105029E96D72DA61A0B821C3C745470F647FDC953EABDDE14B026F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395319, "uuid": "6c08d71e-14f4-4f8e-b595-097b53cf031c", "value": "24:kXCKysE2hi0ziQvZohauXQEqzDXfl91zK7:e9Qp+MsmQEAXf1zK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395319, "uuid": "49235de5-6bb5-40bc-8c3d-7d4c48591f80", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395319, "uuid": "d3caa180-6429-4008-99e2-959c09c3ae70", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395319, "uuid": "d8a4d9a0-84f8-40ce-8d1e-658aa7465d52", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e5ac54-949d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786353829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353829, "uuid": "f4a2f7a2-aee6-42a2-80c3-41664be31c7f", "comment": "Malware payload (Mirai)", "value": "0547a7edd84f6308e6ec537d62b01d74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353829, "uuid": "3c1d8a2b-36af-4d65-8db1-b6a9fbb0664d", "comment": "Malware payload (Mirai)", "value": "67817aebf7f8ca1618ce4dec8937f2f69888d15f34fc03777ae008ca36d2f44b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353829, "uuid": "d1c230d1-8087-414c-b570-1c3630c31893", "comment": "Malware payload (Mirai)", "value": "7f444335358869490869ad15ddfcd9d9bacac066", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353829, "uuid": "2cc8ea07-6feb-458d-89d1-2834ada22119", "comment": "Malware payload (Mirai)", "value": "3aa5ffe5e5cee4c08acf0079c61292363a6ab8ec42bd6ae6c298735c2fccac4fc5a9647d29c8c7746d06d45ea2c499f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353829, "uuid": "4ebd12f3-fc9c-4e8e-826a-ff7238fcf60a", "value": "T17F258D1AB2B2F67DD00BC0304BDBCAB14132F07569322D7B32C5DA343EA6DA51769B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353829, "uuid": "265c35ab-478f-4952-af62-28dff85b3ee0", "value": "12288:iad6DCNgKL6dQusl1tUBdoHfjdxAOEDapo1UvODHaypCoaHXZ9ul/mMAXA:iasCNgBnudKp6o1YOLwkl/mH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353829, "uuid": "18d46376-5d9c-4650-becd-9c9709373a14", "value": 971096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353829, "uuid": "6d9e6d34-dc64-43df-b3a6-3cb72d7dc260", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353829, "uuid": "014268e6-6b01-4614-81b3-565af761cae1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262a9a2c-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372277, "uuid": "1fe74e50-9612-4d22-b98f-ef09ce2f4d5f", "comment": "Malware payload", "value": "ccb10278282b814ec2db61a4d6cf49aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372277, "uuid": "8f1f8f65-31b2-4f41-a549-0cc0b64480e1", "comment": "Malware payload", "value": "67b2545630c4f42fe0d6f310609ad154e5218f566c0137c112c78939621a8ae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372277, "uuid": "0a3b153d-4bbd-49b8-b40a-88b48b9312ae", "comment": "Malware payload", "value": "6e8da76bbc35b4489a1838419b352ecc3b068a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372277, "uuid": "28d5c0d0-5902-4f0a-b52e-298c73e2e14d", "comment": "Malware payload", "value": "775fd25dbaed4f77b112207806e78ebf124a30fb7a36530dfeb1d9457349b0dee839c47c31643d6966a2bd642a33a7d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372277, "uuid": "9d28f7a5-d701-4c99-8bfd-22e468fc6b54", "value": "T144D4F100D685C8ECDC3653B2887BED221427BDBC94B1652F665D76397EB3382507AE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372277, "uuid": "bf0fec55-0819-4601-8871-bde59c891281", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372277, "uuid": "68ba79eb-8dc9-439c-a9ff-e4e371575731", "value": "12288:NtgBWX5wf5EDHNgu74qF8LVZP2Ra08rECC6MB7Z0/sg:NQw7DHNjcA8ZZPwAE3Bl00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372277, "uuid": "ae44795a-c927-49de-87e9-534caf1701dc", "value": 603800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372277, "uuid": "ed3e8975-562c-4149-a220-a86aba1fdd43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372277, "uuid": "1e38e3eb-d57f-49bf-9f65-08e77c196858", "value": "67b2545630c4f42fe0d6f310609ad154e5218f566c0137c112c78939621a8ae0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe095481-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368774, "uuid": "a599873b-cf57-424d-8f41-c78b04de3b06", "comment": "Malware payload (Vidar)", "value": "706760335d4d64e0fb48eab44af2a2d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368774, "uuid": "30cb5e6d-717d-4e88-8d39-47f14ba77870", "comment": "Malware payload (Vidar)", "value": "67e97760f461eedd9fc1d1db45afe4e3b4535aca73355ebdeaf873848342124f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368774, "uuid": "08064846-9dc2-4b89-9cd8-0e809bbc3444", "comment": "Malware payload (Vidar)", "value": "981d02788b78f1f0db838b23ade66165f247388e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368774, "uuid": "d6532163-6380-4fb3-9ac8-0d105b2b3c8f", "comment": "Malware payload (Vidar)", "value": "5f61173a8351e14ccaced61b4b2ca2fd0ce5390e9fffc9bb972548ba45e7027832c0f7be027b1e944bb009177c54703c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368774, "uuid": "c7f6b8f7-f1f1-4dc4-b785-c774cb91a39d", "value": "T1F1828245D01BAAE4C4E2C332636616A359F8B85022765B3BABDC6B3E0D02370F7113ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368774, "uuid": "6cddbc7f-012c-4f9d-985e-4b8b1e094d3c", "value": "16308a646fafd8cbffa509d4eda166ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368774, "uuid": "6ddcd8e2-d7fc-47ad-a64d-09295c549558", "value": "384:OUlnRYZkDS4UCYoEi6h9dsmnpMyb1IsYOsWAqZ04Hz63lJMQ:/SlFiqsmpMK1IsYaZ0C6Vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368774, "uuid": "47951a3d-445b-48d7-8b05-7750b2b13657", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368774, "uuid": "6ac9bac1-3d0c-48a3-8b2f-11c84aea2ae9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368774, "uuid": "035c0fcb-4bc4-47cb-a0de-729f2ba8b2eb", "value": "67e97760f461eedd9fc1d1db45afe4e3b4535aca73355ebdeaf873848342124f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c945091e-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369545, "uuid": "2050e7e9-266f-4d44-af02-1ae76c2e42ca", "comment": "Malware payload (Formbook)", "value": "43d6e0302e5417bb79c17527ac21c72a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369545, "uuid": "bcfe01ed-f5b3-489d-ac34-f37c64fa2750", "comment": "Malware payload (Formbook)", "value": "67f0f61d70d2a446284e7b703b1c780908ffa289ef7018310fc8165c830d2bc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369545, "uuid": "7ec2f5c7-0eb2-48ec-bbcc-d4dbf24d15a8", "comment": "Malware payload (Formbook)", "value": "2c080ba0c4ff3f68ac61d3a31f767c0b5f3fa400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369545, "uuid": "ac881214-a9c5-438b-9c6f-4802f0d41838", "comment": "Malware payload (Formbook)", "value": "07298e6df41f3c4ecf69c30ada55ac5688cd110f7fc620bab6476fc7daa3f15322263aec2b4b9330422d0b94ea763460", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369545, "uuid": "05c83c22-cd63-433e-b2ce-f9de24a404c7", "value": "T1B93512A86B1DE80AE9525B340C70E27C15697E5CEA11D3676FECBEDF79327164C80382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369545, "uuid": "e778fc46-1dc1-49d1-b5d7-a236f1ad4f60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369545, "uuid": "df6bceaa-72e3-4c55-8375-a1985165d9cf", "value": "24576:34vV0LPvFiqSGdxtTrLmNN8+vbnLvhndftnt9lhz70+vaD1U:34N0LMqSGdxhriNB/vhhtntVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369545, "uuid": "6dbf3419-f52d-4086-9569-46292d4341ed", "value": 1119744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369545, "uuid": "2cf313d4-22ad-49b1-982c-631f16cb6898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369545, "uuid": "4ba467be-9b27-4f16-8ded-c10cc8521fdd", "value": "67f0f61d70d2a446284e7b703b1c780908ffa289ef7018310fc8165c830d2bc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87bc24f7-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786371582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371582, "uuid": "3223aed3-cb40-464b-8101-57c1105ddac1", "comment": "Malware payload (XWorm)", "value": "67ecfdc72066ed3e3f7d4c83077eb920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371582, "uuid": "bf2615aa-fe1c-4d5c-bac3-c6bacc260437", "comment": "Malware payload (XWorm)", "value": "68075d0235b433a37fd896eb7b2a2e385cd5c65c34e6b2d0a1f913608d53f454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371582, "uuid": "afe13a37-99c7-419e-80a8-069c86575dab", "comment": "Malware payload (XWorm)", "value": "f65630bd94ed4a6f7150d038b8593e9b51a1d02b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371582, "uuid": "6cca3be0-f160-4a29-83ac-be75a9b8002a", "comment": "Malware payload (XWorm)", "value": "209c796c4a6e73c9516d78a8e864da445d25cb3d3278ccbe731b33c53a85ccc5854f14e918ab1a67a0471e2bde8b54ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371582, "uuid": "93c7826c-ea93-4f73-8e12-5fe931d8280b", "value": "T15384F13D2FACD25AEE720F355CE6F335856C9EA46D518B8B770839297E30F809C49219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371582, "uuid": "ce62e33d-8f43-4890-9060-f49cf1836b7b", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371582, "uuid": "984d7e13-a7c3-4d7d-804a-62eb6da61623", "value": "6144:XT4DtYa/h305o9fgqMUuBQWYmETquqsP7ook3FHPGavEhIWjxKouGuzz87:XT+Vso4DUoQFmETbqsEoEhPh8luGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371582, "uuid": "18017903-55d0-4bff-9628-279f50d453cf", "value": 383928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371582, "uuid": "9840db03-9efb-4ec2-9912-2a2a74341318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371582, "uuid": "e72c53a8-e4ab-4068-8584-7423d0c71e18", "value": "68075d0235b433a37fd896eb7b2a2e385cd5c65c34e6b2d0a1f913608d53f454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cab1a79-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372047, "uuid": "cc792b89-6946-4e60-8f72-c5288705bc24", "comment": "Malware payload", "value": "972ccccde3fdae532452aed62f51ce52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372047, "uuid": "b6409541-9d0b-44b4-81ad-0acf5d6913dc", "comment": "Malware payload", "value": "684e744797db2a1aad3708af26385b4940d07126e2456521b360d9d35ef01b7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372047, "uuid": "183e5ae7-4535-4c5c-8e14-1290cb09c65c", "comment": "Malware payload", "value": "3a1c7775db1586d360a2339474dd783ae97fae87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372047, "uuid": "ad7ae874-287d-46b4-82c4-aaad92f6b3c0", "comment": "Malware payload", "value": "73e4b7bc78c394675b86933394bacd4d523be048039e65d995c5ae55ef00614569df0311e6a036477641d5d2b478c777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372047, "uuid": "5a3f855e-c9d0-4136-acd0-1bce205dbfde", "value": "T15BE6E03362ED65FBE0694639057392155E3B7F3068138D0E96F438F8DB35FA0293AA46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372047, "uuid": "abcf2283-1236-4989-99d9-00b158a5fecf", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372047, "uuid": "32a3ac41-19aa-4c6e-be7b-7a9935c69f10", "value": "98304:6oJJqi90iHyTTGu7Eb8tI9eHAr4y+2fRQBEK6:5X9lyT6uGuI02fRQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372047, "uuid": "48f4dca9-65f4-4e79-8e67-4a7b182799c9", "value": 14601458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372047, "uuid": "e0965b05-9551-49e2-870c-88608c9f04d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372047, "uuid": "46226089-e2c7-46d3-819d-abae31378391", "value": "684e744797db2a1aad3708af26385b4940d07126e2456521b360d9d35ef01b7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b16cf2-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786373889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373889, "uuid": "3e1ccf17-9857-4039-b0ee-75f1ec0fc0bb", "comment": "Malware payload (RemcosRAT)", "value": "acd23e712bd02241d422166b68a4062d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373889, "uuid": "18264b6a-6ab2-4e51-b564-5553e66aef7f", "comment": "Malware payload (RemcosRAT)", "value": "685a9bb96c43e93da315358e0b572334a3c27b1ff5746a406e2b4d9d2431915f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373889, "uuid": "77168554-82ac-42d3-9230-9d11e8f39fc3", "comment": "Malware payload (RemcosRAT)", "value": "1e0df63eb22c3af4887e6bca4d2a4855a7f19200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373889, "uuid": "e93e6912-7825-4164-b687-f8e03e3b66ba", "comment": "Malware payload (RemcosRAT)", "value": "a84c10469f305658f0bbfeb25db621dd9f6b34f38c67f1c5ee951a2a10bd3ec1160772cceed38cff2d32f6594669905e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373889, "uuid": "9eaa1817-5c35-4276-a933-dc7149e9515d", "value": "T121F412543A614B12DAB20BF916B2E1311BF56DACAE32D3062FC56CEFBB57B504818713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373889, "uuid": "7de679a3-d8c0-43d2-afd9-4351caaea182", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373889, "uuid": "d720c097-7406-48c2-8f82-cabb5bb56bc1", "value": "12288:80udLXqwCvXqtHMGMkQDffz6sTJ6ipGgKAP8PAQfSGhBYJ4FAoC/yozdvzAi+Pzm:tudjqFXqpXMHffx1GgKg8Plk4FqPxhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373889, "uuid": "babcbdb3-b2fd-486e-bc3e-66ea3a656fc2", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373889, "uuid": "811c8577-9001-4386-9fcc-da9434262b1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373889, "uuid": "d12aa632-abbc-4e2d-9333-fc7565933f01", "value": "685a9bb96c43e93da315358e0b572334a3c27b1ff5746a406e2b4d9d2431915f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ca5395-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383600, "uuid": "e1e8e181-4441-4b9f-97a0-093b3cf420e1", "comment": "Malware payload (Mirai)", "value": "6f9d16d81f123608309cb509fba65e39", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383600, "uuid": "e3743630-6f02-4be2-884e-140a3efea6c6", "comment": "Malware payload (Mirai)", "value": "689a56e6252bfcae50ec716f3b736ebc1a21bf6a47c152e0a59ab41e21151aaf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383600, "uuid": "465e55b6-e0dd-4962-b83c-df96706cea27", "comment": "Malware payload (Mirai)", "value": "358d82cc57f2fc32fefc5e41a1618522cf304486", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383600, "uuid": "226d2023-551e-4baa-8c57-a0539ac47682", "comment": "Malware payload (Mirai)", "value": "40596b374135c5615f007eb221df367bbfa8af95c2f44f345dddffb201942db365b608aedaddb89ff08ca7b9aaa25ae2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383600, "uuid": "0fe776a2-d76c-4c75-97e1-be8db192a9ae", "value": "T18373F183459EF675CC6EB1723AE749C1A691ED7CED021FF781C930BC885A846D8A1E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383600, "uuid": "a77ee4d3-46ff-486c-bb9b-2b499a45c6d8", "value": "1536:WEZPirpVL/2lE3IXsstWu2inReU5kXAm8+n:HZarbL/FI8S7nr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383600, "uuid": "92476371-fbf8-4bcd-8bbc-e98cd580c999", "value": 76920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383600, "uuid": "814867d4-1566-4baa-92ed-13ab5d2f54e5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383600, "uuid": "7a0039ff-c318-48d3-8b87-3449bf5a8807", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7fcd07-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372397, "uuid": "9b7360ee-a0db-4723-8678-d82de7305d73", "comment": "Malware payload", "value": "4b39b94efe19d4427e3fe525bd85a301", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372397, "uuid": "9c83ec75-0d56-43d1-b99d-4471a6239bb0", "comment": "Malware payload", "value": "699cf1475245e5fe1b790210c97731ae80fc471b9fecbebcc48b28b387757f74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372397, "uuid": "4160a03b-c528-4854-8a36-ba225dac5e37", "comment": "Malware payload", "value": "7b86941c422262755f63f66da071bac2f85d16dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372397, "uuid": "1e8fe6ad-9495-4c17-bbba-b9023826d4b0", "comment": "Malware payload", "value": "330c31b2e45fd6c5e241c55b817382118c0c1753409e496ba9e3c2d4819c6a0c74f296fa57632d49ffc61efc6692725b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372397, "uuid": "03cda386-448a-438a-a312-b01c23ed0a9f", "value": "T13B04021473C9C067D6D3177228FBA2B6A2B6EA680133470B1788BF3FAC317159D1A795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372397, "uuid": "bcb5a647-4f41-4c64-a49d-817af3b352b9", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372397, "uuid": "dede776c-f058-418e-a712-0ab5b90f89af", "value": "3072:1LfVxlyEZfp9zIb45zLNYw6bJrXHB1BHaRsfHUwJ3C7Jn+aDMHtv:ltXZXcMLBS4sHd32kV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372397, "uuid": "fb17c6fd-3f01-4a8b-8304-bc500aba23fc", "value": 183788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372397, "uuid": "9ec4316e-0487-4c41-8047-dd5dee709d5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372397, "uuid": "cb4a0fb2-8103-4407-af96-dcf74cbe2659", "value": "699cf1475245e5fe1b790210c97731ae80fc471b9fecbebcc48b28b387757f74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d355cf-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373674, "uuid": "52ee5f1f-e8d4-4fd1-b926-8ca0ee37b4f1", "comment": "Malware payload (Formbook)", "value": "5a174b868ca2d317f5d9f49aa964c88c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373674, "uuid": "4d0b7cf5-cc0a-465d-926c-a953661e4b87", "comment": "Malware payload (Formbook)", "value": "69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373674, "uuid": "1b93ca58-064a-425f-88fa-8b5541789f8d", "comment": "Malware payload (Formbook)", "value": "ee108ff77cbe984c4bb33ec1d9c16ce1577b34e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373674, "uuid": "5b5eabec-edb6-4ecb-8ab4-a331fcff384e", "comment": "Malware payload (Formbook)", "value": "68bfe6942dbad340e72b4afcd94c0b03b0b9c36b076c0f90f1841248b3663086d1d5eb094bab09b83d307f9125db8c73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373674, "uuid": "86bf393d-4d3f-4527-9d7b-7012d403995f", "value": "T12B351255ABF6EE35CA6106BF8705F6315F2E6EC58170FA8969CDBC633DBBE004400296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373674, "uuid": "d83889c7-8e78-4528-9c8b-02ace6e630b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373674, "uuid": "c818776a-1948-407b-aeb6-156703ee1127", "value": "24576:1NK2aycKGl/VAtK0UZIKXQbKVK+qok/as2Jr+:6DyfiVAQLXaKVfqoKas2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373674, "uuid": "682cb48b-06e7-4a68-b3ef-b5fd0eec666c", "value": 1161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373674, "uuid": "c195cfb4-5198-4eea-87be-e6923553b0cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373674, "uuid": "a32156ee-4412-4fce-be55-57af6ce8e1b1", "value": "69a1769374132e9667137f0e6a407f98a9db086185be2f423e573352e4de59cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511dbb84-9451-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786321239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321239, "uuid": "5b6477c7-856b-4d67-906d-2f4ee78fae60", "comment": "Malware payload (Prometei)", "value": "0ebf523f65ced692e45eb1f6367d4e95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321239, "uuid": "bf4bec5a-f7b2-4e3f-8e3d-b0040d2c1ec9", "comment": "Malware payload (Prometei)", "value": "6a207057c4750722c439c989b3270a6ccb60129a2d61b86286a3edef1f31e649", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321239, "uuid": "ebd2082d-79c6-4bfe-824c-a57e9a1606e4", "comment": "Malware payload (Prometei)", "value": "6ccd1ea583ac5571dbec293710b92c7acd8b49b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321239, "uuid": "4f63117f-6fda-40fe-8de0-526a99197fd0", "comment": "Malware payload (Prometei)", "value": "64e500b64c58233ce6bce9a39206f1c17b269da1503f23c21932939b46c7e1130b870dfa13b3ba52bbc27e2658b8fea7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321239, "uuid": "bc63e7f5-8e88-4741-b2fe-0edc80081678", "value": "T16325337DAF1C9AEC433A971835B1D24B8EC1F8967B27540624BD82F853EEDD36C12468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321239, "uuid": "6b0ff370-ebb1-4dd2-b0a6-c1966094cc49", "value": "24576:lertoMkebO9ErP4/kuxwn4ZCKBAvck/X3Sh5GrMOZrwUUkya8:YrtUegEsxwWb+vck/XialwAya8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786321239, "uuid": "e3a5070e-def6-4448-9d03-39e4172dc2d6", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786321239, "uuid": "e5b22741-d88d-4a7a-8ad5-38ff02c1e148", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321239, "uuid": "7fb1c405-7672-4c99-8e69-9fb125c60268", "value": "6a207057c4750722c439c989b3270a6ccb60129a2d61b86286a3edef1f31e649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd6b40d-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370462, "uuid": "b22f170b-241b-47f5-b7f7-cadb47caf610", "comment": "Malware payload (Vidar)", "value": "86c1d1278d6f71466c35ca8d8a4b4505", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370462, "uuid": "46ec4ccb-1534-495b-8c6d-6d5b6aa56f51", "comment": "Malware payload (Vidar)", "value": "6a2ae68bc27a5f0c028301f2ec5417572d5ed1442af1d9a95a29cf02855a66c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370462, "uuid": "a316bb4f-e9e7-4359-9056-8ea99581da09", "comment": "Malware payload (Vidar)", "value": "8789dd7592c1783e05cbf9e60aaf0809114134e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370462, "uuid": "a56c0de1-806d-4ef5-af83-2aa362aafb30", "comment": "Malware payload (Vidar)", "value": "fe6d7d8082dd54cbd3cec609f17cfc982025c8b5b93e09091b32aa6ae5482d01b7d880c4e6c6361b6a07ecd38a9f1c5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370462, "uuid": "b7afee78-7834-4754-90dc-e9fc1adc1662", "value": "T14A922E45D21B92F0C4EBC337675A922365F8BD152236A63BAFDC56355E42330A7182EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370462, "uuid": "a6fafd9b-d094-4dd2-83f2-857ada0831e8", "value": "1bbed67eef2c885e172f4ab0f7e6b4df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370462, "uuid": "f63f28c7-023a-4419-ae44-ecb2bedad3be", "value": "384:OEi7Po5XSgtVinfP1Zygwi9lEffEIc9pP+BZXwcF8hb8lDH:UPYXSJCg7lfJcZXtUyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370462, "uuid": "26fd7aa0-c706-4775-95e7-594b18f93c1e", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370462, "uuid": "d0ccf7ed-a1b9-4d56-a1f4-d7f01758e6be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370462, "uuid": "850d4a21-212e-44d3-828c-b6bdd9908eb3", "value": "6a2ae68bc27a5f0c028301f2ec5417572d5ed1442af1d9a95a29cf02855a66c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690a38e8-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786369383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369383, "uuid": "e8c87248-e18c-4528-a5d9-d3928830a5cc", "comment": "Malware payload (AsyncRAT)", "value": "dd8e33c02d8e2fb04e2fc55766d77b84", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369383, "uuid": "734ed16d-9f65-4c27-a57d-b04273b75acd", "comment": "Malware payload (AsyncRAT)", "value": "6b555912da38f884965345b7012569f6ad38292fb073157b4ff4fac15a00cc26", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369383, "uuid": "1b1a2385-3c22-42a6-bc44-0ebc6ed0a8f5", "comment": "Malware payload (AsyncRAT)", "value": "9472dd4c5eda5cbe9a91a7d5770d56c247bcc5a3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369383, "uuid": "49d88577-d4d3-4419-b123-eb7ef9123431", "comment": "Malware payload (AsyncRAT)", "value": "fb329cfb7af7bfb5b2bfb1d09de5771bd942696b2df378a74f4093b9716de74a26ffdf3bb3a999700eff428bf99502fe", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369383, "uuid": "a9826919-6f5d-4fac-b48a-36e423830e1b", "value": "T1BB15F10467A8CD03C46A5774A8B4E2380B796E19FA11E3174ED4BDEF7DBB7228C54287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369383, "uuid": "af93dc9d-9a2e-4414-9402-d1aaece03a75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369383, "uuid": "35e52395-6474-4062-982e-0320355939d1", "value": "12288:iLYxXAvNZVXEcOzygcCwIj1qOIFVET3JS8b2DAYpUho3fW8da1dLFACgy:DAvvV0Lm8PKET3dWppl3fBZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369383, "uuid": "30e6fb07-0f3a-44c4-b961-caeb6f627ec7", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369383, "uuid": "7244515d-f51f-42c0-aed4-7d7668b78ea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369383, "uuid": "f41800b5-74c6-422e-b83c-64d7f1fb56b2", "value": "6b555912da38f884965345b7012569f6ad38292fb073157b4ff4fac15a00cc26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb7a02e-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373822, "uuid": "b6bb56c9-0129-492c-93d0-28f3e9ca0178", "comment": "Malware payload (Formbook)", "value": "71a62992b2883cc9fe6f7f73b37a9607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373822, "uuid": "abb34139-d1df-497e-aa9e-87dad613e84a", "comment": "Malware payload (Formbook)", "value": "6ba7f0ca733d826c160f4ad7a8e49b3ff673defb477c47b0621b048baac67450", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373822, "uuid": "a2c43fff-15e6-454c-8c65-e062bab90f2c", "comment": "Malware payload (Formbook)", "value": "0d221af75a856028db4ff589c8de6c6b69dabe27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373822, "uuid": "09f4ecfc-8dd5-493a-ab3a-fc729289417d", "comment": "Malware payload (Formbook)", "value": "22d40489ebf97717d21139ff11decfcce419d3888d6989233c3db5bee3c120227d2cae3500b5b8b9d454a9022a5c87bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373822, "uuid": "2a74796f-34a2-4f9a-8400-1314fec9552b", "value": "T17325232516D88E17D8BB1BF942B1C43527B57CCDE939C6198FDB2CEB7896B200920763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373822, "uuid": "71458de1-0ec3-428e-8027-549e9ff418b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373822, "uuid": "81fa45cb-ca4e-4957-a452-ce37f972827b", "value": "24576:bGK5Q2zG1MA4Kcj6Sq3RpIGNK01U1GlKoh7xV8sl7zOfiX:yY011T2MKKNRYiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373822, "uuid": "56bfb676-07bf-493f-bcf8-c0ed9d5459f2", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373822, "uuid": "7b4e3e95-112d-401c-a306-f5a8b724e258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373822, "uuid": "488fee8b-bf83-4830-8026-c040b2d46c62", "value": "6ba7f0ca733d826c160f4ad7a8e49b3ff673defb477c47b0621b048baac67450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747c625a-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (a310Logger)", "timestamp": 1786371120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371120, "uuid": "25330fe7-5a2d-414e-ba4e-984200c015a7", "comment": "Malware payload (a310Logger)", "value": "e1ae133210bcc6d46f40dc4284fc97b0", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371120, "uuid": "f3e8b3bc-91bf-41d6-8048-40fa5e09b55e", "comment": "Malware payload (a310Logger)", "value": "6bfc1a89a58ec4a73de17f7fdb3e8b470c132e7410fd8a7f4fe9b4771159e08f", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371120, "uuid": "bd44bf09-6ed2-4f34-99bd-d0bc63984421", "comment": "Malware payload (a310Logger)", "value": "d395f90ef96411a71c9714baf88ed2bb59d85c76", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371120, "uuid": "0f331d0b-a04d-4274-a185-cf6d9e631f65", "comment": "Malware payload (a310Logger)", "value": "0d701707162c0c41eca929b21efe24c7bbb32d932fe81e07b0c35d2dfec3a28a94054bb13bf96ed0136d557a28ebae61", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371120, "uuid": "9daa320d-bf46-4e9b-b43a-d7d425f7dd69", "value": "T1DF944A13EB60A11EF1A389B0B9B5925A68267D351B98EC4BF3409F1A35715D3ACF031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371120, "uuid": "522a7ea7-36f0-409e-8e1e-9becc3e84766", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371120, "uuid": "86efb211-b070-48ac-b66c-ffa19e8dee9d", "value": "6144:O+8d1/w5KA81IJ8GpF6nuTmOOUiBUrjWBg58zNCQWFiuSxcbyuXu/lD:ajYKkJj6GmZUiqrSJCRpbyuXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371120, "uuid": "88428309-39eb-40ff-ae89-29fb9ed1817c", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371120, "uuid": "6ae8e6a6-b9fb-4afe-b71d-4e45c3793910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371120, "uuid": "14783efa-d0eb-47d8-8556-bc3adfcf40ea", "value": "6bfc1a89a58ec4a73de17f7fdb3e8b470c132e7410fd8a7f4fe9b4771159e08f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5339b9d9-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786370635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370635, "uuid": "10feaafd-1907-4913-bdd0-b7875d47e07b", "comment": "Malware payload (njrat)", "value": "497071f4d0445ccb26bda1ee0056ade7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370635, "uuid": "3453c00f-b15c-4b2f-bcb1-86be667d95df", "comment": "Malware payload (njrat)", "value": "6c09247849aa700f0c79a851fc08db8a0525a52d8bbcce5e547002ade3617c86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370635, "uuid": "94ce3105-52ed-4364-ad3a-d4b2a22153dd", "comment": "Malware payload (njrat)", "value": "1fb5de54ccfeb870d8da0185c909acd345819c8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370635, "uuid": "78a333b4-89d9-4b32-a93d-182162275de4", "comment": "Malware payload (njrat)", "value": "bc45c74eacddc363346414bab282c1a942c2e8a21d0f663fb1619be543213ae417b55805133c56f36dc75fc27ef17e94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370635, "uuid": "0ae3fdd9-0a51-41aa-8156-f9f5ad654a37", "value": "T1510522146F16DC12D4D24BB408A0F37E92705D4CEA11EA978AFEDEDB381D90B9D09B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370635, "uuid": "ba6a25b9-9101-4be4-84fc-43d1d4a1a2a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370635, "uuid": "2727e1ac-00f2-4035-b1e0-9a6ae055acfa", "value": "24576:JP/k1AjRJACaeAhihCHy/6PAVjBJuNGCMJcZJA:JPM1AvIxhm1/6IV1JuNRMqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370635, "uuid": "1ea9ae3a-3fa0-4e08-bf80-5abbd8178ed9", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370635, "uuid": "cbb74993-9815-4529-86b4-ac5c269cf1fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370635, "uuid": "6a3dd17a-897d-4cc6-bf46-9b58945a267c", "value": "6c09247849aa700f0c79a851fc08db8a0525a52d8bbcce5e547002ade3617c86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7324bf-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340208, "uuid": "b3fd6104-d844-4c31-854c-f7d663ba34b0", "comment": "Malware payload (Mirai)", "value": "5deee7c9ff907aa242aa066f44e17a9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340208, "uuid": "3d199469-6ff9-4112-b7fc-7709552c33f2", "comment": "Malware payload (Mirai)", "value": "6cbb8331f5387b638ac0dcc8d5c75a95c85c36829651f0943cd7b5d874c51b4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340208, "uuid": "9014fe7a-094e-446d-a4b1-c1c187eb3be6", "comment": "Malware payload (Mirai)", "value": "85408120be040ec04de189fa7feb75197cec8bd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340208, "uuid": "44a241d9-8b10-4c0d-b595-fb3387319bbb", "comment": "Malware payload (Mirai)", "value": "86e4baef84380be9e5d9933614bc76e75aae655662f66e044808e624f586460bdf1ad55033046e5f9c52952ad1399c18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340208, "uuid": "55ff0037-ecc6-4508-8571-93e543c1362f", "value": "T1EA840C98B5F2E2CAD1D4EAB5F319784D37530776B1D73146A50EDA3322EF18809BDA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340208, "uuid": "e764f27e-58cf-4d4c-b318-71b7f8c2526a", "value": "6144:ihlYa9szsODsj3JsjdFEsvQUzZVJk1dj4WAsgHd0g3SIG:ihlYa9sIOUsjX5nWJR00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340208, "uuid": "64c67f52-2bf0-48b4-9cfa-8525f012051e", "value": 397360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340208, "uuid": "05c0ed12-1a97-43ab-9067-0d8fd4f5ef37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340208, "uuid": "b032c0d0-1ce5-4922-94b1-59945546dcc3", "value": "vlxx.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5550874-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (a310Logger)", "timestamp": 1786368625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368625, "uuid": "3c7e8aa4-2829-43fd-8542-fff719ec2d06", "comment": "Malware payload (a310Logger)", "value": "5e8eda40b07f656d2830ef46a511f257", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368625, "uuid": "b09bd773-9fdd-43ce-bf2a-3667a175ec63", "comment": "Malware payload (a310Logger)", "value": "6d32ddd615e27531c7330421698ad4eccaeb96b9eb6aa5b0fdb5a92ebe5fb4f1", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368625, "uuid": "d53b2089-dfae-4ce1-93b7-67633cbe57c1", "comment": "Malware payload (a310Logger)", "value": "4492295a63f3f3e5bd2101100d2dc77e264aeace", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368625, "uuid": "527efbd4-43a9-455a-b429-a9a25b85fb42", "comment": "Malware payload (a310Logger)", "value": "5bd1dd99c3e48b969133885aa0f44511835f437e43be781d167bf43894e277ee9cbbd9567b4bcbf1bbb7fcebbb9cd2d0", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368625, "uuid": "4277edbd-6605-43b4-b020-5efd142592ee", "value": "T1625502C03B267709DEA86A748935EDB853A92D387010F5E22DDE3BD7B9AC2115E1CF41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368625, "uuid": "4f9dd73e-f16c-4deb-b781-9c2fd2a69cc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368625, "uuid": "04a7910b-0606-4a23-a2c1-725ba027449d", "value": "24576:WqGxQdftNe9ceTVc64AaIDqPAFIDdFx6rcEtfir2+x4E:WhxQNeXTVc3A5qPDjAr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368625, "uuid": "5df1e97b-5b9a-4caf-89ec-e2a3f5e4eef8", "value": 1353216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368625, "uuid": "6f2e435e-e23d-4519-8ff3-4ba25aa73840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368625, "uuid": "f781e690-25b0-4f75-a7e9-af4f69293ad9", "value": "6d32ddd615e27531c7330421698ad4eccaeb96b9eb6aa5b0fdb5a92ebe5fb4f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac845c44-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368637, "uuid": "b8635ae2-7b8b-404c-afb6-b4cf23b8efc9", "comment": "Malware payload (Vidar)", "value": "c935d058a27d8a21cbe90f9836421acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368637, "uuid": "e97389dc-c15a-4a39-ad1f-7a980494623e", "comment": "Malware payload (Vidar)", "value": "6d3b76ff9cc0ab462e84766e2bd86f52f6a0480b0c40cfabf7780801d4eb5518", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368637, "uuid": "ff36c20e-78eb-461e-8b20-a0606f146b08", "comment": "Malware payload (Vidar)", "value": "681c0aad26d76749b5526e463a1b69c8568e8d3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368637, "uuid": "5cba2b2f-55bf-4a75-91f1-b8db246fcce1", "comment": "Malware payload (Vidar)", "value": "ddc284dc3616e1d19317240d23b38860872eb395f2934b18488eaa1747403b51fc18c7d98b7e14c1219246f6226c6c14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368637, "uuid": "8d838cdf-5f59-491e-bd08-f13fdfbc4e10", "value": "T16B52FA9AB1E1B2BDC0688379DADF0672DB6534C463345AFF12DDD7647A83111A2BCB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368637, "uuid": "e75f5fd1-f7b2-4c34-b9f0-10e924bda220", "value": "b6039ed47f96f82fe109de7070ac3ad1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368637, "uuid": "877a2e3d-9d1b-46e4-84d2-76209e4670e2", "value": "384:W8O0RUGnoh8k6sk3/X8cIIRmrS01KylwS:Nzxk83nyIL0Lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368637, "uuid": "21a5b388-3ce8-417d-beb8-c894ce20b235", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368637, "uuid": "0f569960-a4c1-42d5-ba67-3adeda84672a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368637, "uuid": "b3a1f155-fbc8-4c82-b7d1-3437fa409364", "value": "6d3b76ff9cc0ab462e84766e2bd86f52f6a0480b0c40cfabf7780801d4eb5518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac147fb1-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786370784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370784, "uuid": "722d2f2e-769a-4081-99d0-d7f6d803967a", "comment": "Malware payload (njrat)", "value": "7282a626a48bd93b48c5dfb418a09f72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370784, "uuid": "4ed79d84-011d-49ea-ba46-2e3656148d73", "comment": "Malware payload (njrat)", "value": "6d634ef3e9a35d3373b21c747969fb2d251179b56dbbc92f1f5b957c9fd7edbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370784, "uuid": "1f4de157-c0bf-4d0a-81b2-df5ee924fc33", "comment": "Malware payload (njrat)", "value": "a400fe43642420184a35bc1f65b5d78ad3a1f3d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370784, "uuid": "f5bfba6c-e33d-4da4-9bdb-78b051189433", "comment": "Malware payload (njrat)", "value": "b77e686211aab8d014d350812baf89df44e3d382914ee6b9a95acb69a59b4ff4c20df5bd024935f354e394336421179b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370784, "uuid": "9db3ffe1-42b7-405d-bacc-49ccf78947d1", "value": "T15F0512942B5AD801D4E31BB564F0F33852709C8DFA11C357CAFEBEE77119A1B6C18962", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370784, "uuid": "0f430ac2-42fb-4401-ad76-7c02df475ef3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370784, "uuid": "270a2aa5-c9c9-459b-8139-6c12bd81ba89", "value": "12288:9k36ivvOro7yYzhODnJbu0Z00JAp6grpz65ixo9nKaG2qz3MrThPxhaNYfsYz:iGxTtL9JAEgrdWiQnFG93MXHhPfsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370784, "uuid": "08bde3fe-00a0-4cbe-a2c0-e556b970a57d", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370784, "uuid": "0c632d45-8fce-4615-8881-a9c44d37dd81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370784, "uuid": "a5980b04-5874-436f-8caf-694e8bc43816", "value": "6d634ef3e9a35d3373b21c747969fb2d251179b56dbbc92f1f5b957c9fd7edbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff65d307-9466-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786330551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330551, "uuid": "762c55fe-fb96-4a24-94e5-8a54b8b33793", "comment": "Malware payload", "value": "f8e6153cd86bb5d3d93fc2643307f81c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330551, "uuid": "4aaa739c-1563-48e5-babf-745e0d2b6d5e", "comment": "Malware payload", "value": "6d64158bcadc565048d868ad38d61624ba19bdafdb88c1fa1b1035a2f108eef7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330551, "uuid": "eff9051a-ce0e-4b4c-ad9a-9d51160ed9df", "comment": "Malware payload", "value": "6cda3449243ec6db2e46053c2acd7717d54330d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330551, "uuid": "b10e2391-0add-4f43-a0ca-4dba3d6c48c9", "comment": "Malware payload", "value": "708f06d4fa9de306e853c6c0d7a7ee9fa68f60f510bb127c1d5a152661451bc18d2853592d531687b840eec835a3ca01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330551, "uuid": "5c7d5182-473a-4f71-9835-f30f31f4c066", "value": "T151533912B388FEF1CE94393060C191B4134D1CF257C5A8E6E58CF2A4697361BBAAD79D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330551, "uuid": "a6524c7e-9579-4c69-9f6c-ffc57a454488", "value": "768:0T9G/XIh7GCtBfcZbkh8eIxYR3/y6YHOG5DTLLpz0o9D6hhSeRE5:0T9GwhqCnfcZY8eIxm3/rYpLxNZ6hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786330551, "uuid": "4db7c6c3-e8c8-4e9b-9c6c-cd60c5aa519a", "value": 66340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786330551, "uuid": "9aad947c-b78f-4f99-8271-993904838857", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330551, "uuid": "55c62c8d-d147-4468-9f5e-9df47204ce34", "value": "main.sh4aeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f993dd6-9493-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786349503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349503, "uuid": "b9a95cb4-4232-453b-b015-c54889c8db26", "comment": "Malware payload", "value": "b56e6162b9857aae36fd00d5e2ec0ab5", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349503, "uuid": "cd3a92e1-1952-4b2f-a6b6-c2d12e58bfdf", "comment": "Malware payload", "value": "6e0cc362c4fb990304c67d1c6e4d60d429e400bbde2df5917a7a702c1c0f3b96", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349503, "uuid": "aa46fbf8-6fa5-4a6d-aa10-900b3d107b5a", "comment": "Malware payload", "value": "53d1e569077b6fe1f403b4799fbb381683c92723", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349503, "uuid": "0119f606-ca48-4a47-a0f2-3ab5117fe9e5", "comment": "Malware payload", "value": "73d796475ea1fd1c7b6df5754104ab261b2832d72dd297b6e8f4e1a5a4c4cb61a86d4a080d2a51197b642466bce18077", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349503, "uuid": "105529ea-582e-4564-83d6-3556ff633175", "value": "T18932F6CCAF9063F4F29303CD37AF2999136561CB504CD880F68C6DE06F4B68D4A86E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349503, "uuid": "e3049910-5fa0-4c83-8a83-0224f188310b", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxz/lX42AiYOpzfMFqBJILl9CX:sXX+/DV7k/3/lLAiYOpzEMIp9CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786349503, "uuid": "be53931d-0bcf-40e3-a57c-06255ee8b357", "value": 11966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786349503, "uuid": "0dc27e30-fc1c-43ad-86c8-cdf775858d1f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349503, "uuid": "130cad11-2f36-4a96-9f9a-9e7160b8c992", "value": "felixReport.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af91185-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368527, "uuid": "75917aaf-e61a-4d00-b072-90fd6e05e1ea", "comment": "Malware payload (Vidar)", "value": "be2acfbdeb158112955f9ed2b68941c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368527, "uuid": "a8a8e176-e9d6-4f93-ba35-e1f5c2bd3242", "comment": "Malware payload (Vidar)", "value": "6e3aaf64e35db2811ea1edc83e88cb002d76bb2bb1691d1f0b8943f462aa31ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368527, "uuid": "d0ac9856-6c86-4ce1-b8ee-2a5ea037dedc", "comment": "Malware payload (Vidar)", "value": "8c1b111a25ddd1dc9a26ab2705e3f5478af47762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368527, "uuid": "e40d3463-c639-4408-8c54-d09bef8c3f91", "comment": "Malware payload (Vidar)", "value": "2c3392ba501d6c2fa77f700e413a2d0ffb799dc23fb6bdb8bd4839882ff3257abefc96199dca741a0dc22b8331a060ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368527, "uuid": "964ff24e-5560-49c5-aff2-f40e7f8919d8", "value": "T1DF82B541E11B99E4C4E5C333672E52A755FC7C2022356ABB5BDCA63A0D52370FBA02EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368527, "uuid": "9c0f3fca-6e1e-4c94-adfe-2ddf06720747", "value": "85b0aeb0d13fb5c7226c80e10830c4fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368527, "uuid": "7c090a3a-8f89-4060-a402-b1262118f242", "value": "384:aVCIp0FrUpIm4ZEBCLRNWWgMhCKZ/m/sxSlw:aUHisZEBCDG4+/Pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368527, "uuid": "2bde73f7-ccbb-43ad-b856-38d5992aca72", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368527, "uuid": "f7cb1a66-325d-4511-afa0-124853cee2d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368527, "uuid": "3cc3ee28-5753-4708-9a8d-2366785e4a91", "value": "6e3aaf64e35db2811ea1edc83e88cb002d76bb2bb1691d1f0b8943f462aa31ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24afa549-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369269, "uuid": "788f7923-050b-4b9a-8a2c-f54dfc24ef3e", "comment": "Malware payload (Vidar)", "value": "ede040251fbf14f67b57056f6f9980e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369269, "uuid": "a6294641-5c65-4769-9a21-b141c1532220", "comment": "Malware payload (Vidar)", "value": "6e80b575ef1deb11360fb4b8e336db460db9c0a013deefcd02a9b99a9bcd8572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369269, "uuid": "3277bc8e-c294-4022-b358-b1d60e23c2f2", "comment": "Malware payload (Vidar)", "value": "2b3cf71442d73f8a59eee0c865d87f96f03bb69a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369269, "uuid": "d5dd8bf1-1193-4774-adbd-f6217bdb4db3", "comment": "Malware payload (Vidar)", "value": "60e74f819a835ee5aa495684bc7752a74e1520ceaf960a72bee06b94c94d0e159d9616fdcd5ebaa54e1d672ad05903d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369269, "uuid": "25c2f243-0995-4bc2-a140-9f3b68424d7e", "value": "T109827341E20B52E4C4FBC333A756512756F8BC052235AB3B5FE89B715E92730E6282ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369269, "uuid": "68df6423-00ae-4d14-880b-4b7a6d8e91b2", "value": "147d9559d7e86cc7d3c43b072d063583", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369269, "uuid": "c5380585-ae83-4aa6-b264-4c5bbf69a4c5", "value": "384:OIvopoiFmHSCuQZgyJs0u5mSq8absWVlR:LvqmyLQayQq8aBPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369269, "uuid": "e3dad73f-cda9-404b-b8c9-49156c514ab9", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369269, "uuid": "410851b8-1284-4d8f-82c0-5605ca2295b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369269, "uuid": "62bb5cee-c88c-40a5-9dc6-47a49bcc8fe8", "value": "6e80b575ef1deb11360fb4b8e336db460db9c0a013deefcd02a9b99a9bcd8572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0851417c-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1786373086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373086, "uuid": "1cfa6b1f-bd04-437d-aebb-81ecbf518fc4", "comment": "Malware payload (Rhadamanthys)", "value": "68855abb0d31bd2ff47a95a18ec255c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373086, "uuid": "b2bccd62-7a2d-4421-9061-168578ab0bd7", "comment": "Malware payload (Rhadamanthys)", "value": "6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373086, "uuid": "33183d3b-1855-413a-8ab5-9c9ae7cd03bd", "comment": "Malware payload (Rhadamanthys)", "value": "ef2ea8de20d62f06aae88341da12c1b35dd5cb3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373086, "uuid": "846f171b-a912-48ed-b867-b449ac2a3c75", "comment": "Malware payload (Rhadamanthys)", "value": "37ead85240f15896458e360659fdf1ec0a709e2954677255c63d750ea0b3b67d88b64c6b2d1f5a3d8df0177fc308e8c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373086, "uuid": "e1129cfb-e519-4da8-ac83-f51aeb575013", "value": "T13EF4CE06C7C266EDD64BE174C5228B0292B3BD205B01EFB6A1B9C795AE738CC1F75790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373086, "uuid": "2a71f00b-b309-4795-b601-b8023fdf621f", "value": "fed1bc871b298c8001a47718fafe9ff5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373086, "uuid": "efd9f93e-c886-47b4-b470-83651a543940", "value": "12288:worUeSoB3z3BPdcogz5CDOaReJ7JjiPTmUqEztVkFbZVb5E5Vx+CcyFOmR6yl:wobSSxPdc5dC6GSUq0tOm5iCcyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373086, "uuid": "c5d4a15b-f24f-46aa-b982-166ad01bb160", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373086, "uuid": "d1c0e049-533e-4e69-b7c6-140b2228213d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373086, "uuid": "931a1b1d-f642-4671-b50b-f5a400971c57", "value": "6e837d22a6bebf8bc350a6b5e932816f0e31c4a78fff917acee09bdac29313d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c87c99f-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373281, "uuid": "6a911910-93d0-46a3-9c44-824a6e1e3e83", "comment": "Malware payload (Formbook)", "value": "056590a3c9ed877064207e74dd8b8411", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373281, "uuid": "40f976f6-faa8-418a-a862-6fa373c83c7a", "comment": "Malware payload (Formbook)", "value": "6e8536a9357f44f364359022cae1f4e6bca7737bfee92508a769dae863064cec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373281, "uuid": "4e6cc6fe-2546-4632-a4ae-edcb0c87fdd2", "comment": "Malware payload (Formbook)", "value": "6339c68e739c87791fba8cd1b9f80ac08a01c7e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373281, "uuid": "5e810969-4f8a-4f76-9ee8-25f296801120", "comment": "Malware payload (Formbook)", "value": "4ba072b22b517235ab53203b2011198e39d5dfc3ba3ac00720c1d0c0fb4fdb82565295a7265168ee2862c1a79a14c627", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373281, "uuid": "df423e75-853a-47b3-bbc5-d4825d34328e", "value": "T17654238E6B22C373E27E3935CF494247E8A7A631B17A90337385F1DE531A9E075C5512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373281, "uuid": "38d318b2-f856-4136-827e-7f53fc5a0a58", "value": "6144:Anqp31RX1uZrLoDdt8VU0L23Vy8PG0WtWeAiYBcXsaXhzYlsnkK3:AqJXIZEL8WGN8w+qnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373281, "uuid": "62783032-4558-407e-b3ef-2bb97dd3804b", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373281, "uuid": "9b989f99-9105-45cb-8bd3-eaa0609bf9f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373281, "uuid": "f27d3d6d-c49b-43ab-b06b-da4fe3c10e10", "value": "6e8536a9357f44f364359022cae1f4e6bca7737bfee92508a769dae863064cec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f224bae-9452-11f1-bd95-42010a9c0009", "comment": "Malware payload (LxBaseRAT)", "timestamp": 1786321612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321612, "uuid": "1d3de4bb-6a8a-41b7-9cdd-8c6c84dd0b49", "comment": "Malware payload (LxBaseRAT)", "value": "bf5be826908833f55e850ea0ba85d3e6", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321612, "uuid": "8689e2c1-f3d3-4109-9ba6-249476973896", "comment": "Malware payload (LxBaseRAT)", "value": "6eba72e816768b1c383487af637ddc3d64e5feacaed1bd7312b983bf28478ecd", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321612, "uuid": "59830477-e494-4932-a51c-ce35ea33ebea", "comment": "Malware payload (LxBaseRAT)", "value": "d67a15dd0a498dce033bb588377485aa038e545f", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786321612, "uuid": "116e42ff-c5d8-4fd6-98c2-8586fb615cfb", "comment": "Malware payload (LxBaseRAT)", "value": "956e21c8d2f6d21211739a6abd2bfec43224cc07c9cc1c4d49b6569d4616d796d90e46077029060b07eda7c278d407c6", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LxBaseRAT", "colour": "#EFD038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321612, "uuid": "b49359e6-1fe6-4ff2-ba2b-1fe0b86f31f4", "value": "T1C6C5F1383CFB501DE173FF716EE8799ADD9FBA33260A645A204503478B12A81EE5253D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321612, "uuid": "3731ce6b-c616-4897-a5e7-199d01690f5e", "value": "24576:evzqEiCYdfvuxgDnn3/MAj351zcU/xj/irv7HthfzT6CM3:J2YdfWC/vcUVijv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786321612, "uuid": "b3d9ed0f-ebbb-4c3a-92a3-e1360d075165", "value": 2654720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786321612, "uuid": "4d7f084b-b2f7-4058-bc17-97bc3614253c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786321612, "uuid": "6f50c411-138c-4ad1-bfd5-6599bce6db83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53bc11d-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368196, "uuid": "a6aa8d6e-0f7d-471b-8b72-0df8e162dae9", "comment": "Malware payload (Vidar)", "value": "925f9b5e1d7e7ffd66f3168dea250b9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368196, "uuid": "98b1591c-0af2-47e5-a763-2faa8f0604ce", "comment": "Malware payload (Vidar)", "value": "6edb7369b387b29e443946e9696c3dba64087053cf844d637062116d1a44aa7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368196, "uuid": "698a4230-ec8f-4cb5-b349-fb2d7ad3db6e", "comment": "Malware payload (Vidar)", "value": "b55b6c18c2c04f16d50af24636af014c6a04342e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368196, "uuid": "96365f36-81f0-4c83-b1ac-dde302ad0393", "comment": "Malware payload (Vidar)", "value": "adf1844d500f8ae1ba37c224d16146c83234f1a91381facdce1d9af7b6f4482b8602bb318aabe150533f279db4869a08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368196, "uuid": "2de81103-e952-4e37-8975-7a1405690096", "value": "T15B52068A71CBA0F9C1AC83B8DA9F03B7DA27341847255FBF61FC4660268331175E8A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368196, "uuid": "7f140daa-ede9-4b7b-8b54-fb6963eef014", "value": "b5dedaa92e3b299ba2882a40f166187c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368196, "uuid": "0b53b272-d090-4c76-b89e-e470c2a5eef2", "value": "192:ODboPjEulL85SVuLk/1FVBTMnk+0wC5ih6GpSGxmD33Vje:OD0bEux85lq1FbQ3Ckh6WSYmD3lje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368196, "uuid": "52949243-10ba-4f71-aa43-867f6bcf5667", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368196, "uuid": "aa3f0f9b-6162-477d-ad8e-1d164c9a3e80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368196, "uuid": "d8b3723e-6e71-410c-ad33-cea822e60b91", "value": "6edb7369b387b29e443946e9696c3dba64087053cf844d637062116d1a44aa7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c77956-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372007, "uuid": "1394cdae-4824-497c-a2d8-ac435284236c", "comment": "Malware payload (Formbook)", "value": "1c2dcd1954c559e812591517521f1d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372007, "uuid": "e71f713e-636c-4aa9-8526-1390e8df8122", "comment": "Malware payload (Formbook)", "value": "6ee6573152bfc2b0c309e67aa2c766766bb1c41a7f89155fdee2ccbec892caf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372007, "uuid": "5bf87233-a0a9-4e1f-a5c2-cfb3eed9a83f", "comment": "Malware payload (Formbook)", "value": "f66e461ab0a77babd58ae5f6bc2bb6b3d232f618", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372007, "uuid": "3bdbf458-b6f8-4e50-8e4e-c7464a717512", "comment": "Malware payload (Formbook)", "value": "3eaa341b9b056c23f75bf0e93ef360807cf3fe5717a53a81ceb3430ed7a9a4559e47bccad57c4552954b4583633a6d3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372007, "uuid": "913ba522-67b5-43ec-b1c8-17d6e0b3d2ee", "value": "T1CE25230C2D56E607C8651B7959B5F57912BD0EE9BC01E7278FEABEDFF9329088C80142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372007, "uuid": "ccd4186f-52a6-4ecb-a954-592a4a91cd2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372007, "uuid": "b1ad2ac7-18e1-4bb1-9c61-8279623bd285", "value": "24576:l2vmgkszvIJTvoh7Midyyt6Cqz3B5zzQWz:l22GIpQh7Pyy0Cqz3TXQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372007, "uuid": "9c0567a7-16a7-4cef-9841-6402231a06c3", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372007, "uuid": "99c5b8c1-78eb-4d05-a456-d291ff82e417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372007, "uuid": "400dec2e-73db-456d-b9ff-8a3af08f618e", "value": "6ee6573152bfc2b0c309e67aa2c766766bb1c41a7f89155fdee2ccbec892caf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaeabe58-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372930, "uuid": "72848d9f-865b-482a-afa3-7b26e08cbd56", "comment": "Malware payload (AgentTesla)", "value": "36012efe7e9b3d49b2cbf1bc05f624e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372930, "uuid": "c0bcee46-4413-4c17-a687-4621852f87ac", "comment": "Malware payload (AgentTesla)", "value": "6f33c793d1bb7673c300e9b87f7ffca6d17885ab3f92c5958f84e75faf1e884b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372930, "uuid": "60cf32f6-baf7-42d7-94cd-6ef716d032c0", "comment": "Malware payload (AgentTesla)", "value": "4bf24f059e0372f87552551d60cd1c5ae697847c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372930, "uuid": "0fbe6047-ae90-41a0-9472-bf3bee5f7845", "comment": "Malware payload (AgentTesla)", "value": "a3ba01237f2a92f8ac1b7572581ee165f1f47eef8e87ac10f3b5e51da37739bc7a5a1f0ee02d104713bbe7c96174fe65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372930, "uuid": "ceb85322-46b4-4c71-89af-cb86bed94745", "value": "T1F24402113386C96BC8525770EC6A89F74B10DEB4C677831B3742BDA979312C29F0D7A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372930, "uuid": "033acffc-6933-4ef8-aae9-bc0b863c2b5e", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372930, "uuid": "7848b2bf-0046-46a3-a606-0f639e61b595", "value": "6144:jB+pgU8O2WlqNhtWMZgfl0N8MzEOwQSx6NHByywzg9UqAr4F:jgUOxlCnW8g9vpT6NQg9mMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372930, "uuid": "16c474c9-513d-428e-b07c-c324388c422e", "value": 253840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372930, "uuid": "adfafeb4-aedc-4162-b9b6-ce933bcd9a0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372930, "uuid": "6db06b6f-5f51-4f91-b61b-cc809b37ddc0", "value": "6f33c793d1bb7673c300e9b87f7ffca6d17885ab3f92c5958f84e75faf1e884b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec574a0-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369527, "uuid": "391382ea-3a18-424c-a24b-3bca382febba", "comment": "Malware payload (Formbook)", "value": "4f2f418d29102aff7386f04fc8db98e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369527, "uuid": "62b4faf8-3744-465e-b3be-fb466f8333b3", "comment": "Malware payload (Formbook)", "value": "6fad973fdb78b0658af1f962ef1d000631e36bfa34d0c83d0632759805e72852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369527, "uuid": "d6866256-1f60-4102-81e9-da84d2d5abf8", "comment": "Malware payload (Formbook)", "value": "51a6f297c2984963ded31f38a87ad3439f58088f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369527, "uuid": "7439bc7e-46ce-4c8c-be82-ab233ced583a", "comment": "Malware payload (Formbook)", "value": "7eb9ba2fd7a1bcb6fdbcc1619c212c39aa250e8308e593874d5002ef8078ba72bd3897908f86f1d060cbee4357d45001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369527, "uuid": "1f2a33bd-11ed-4f34-90f6-cb6a460e0ca6", "value": "T1034501486798CD06C46A1774A4B4D2B80B79AE59F911E3031FC9BEFFB9773225C09287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369527, "uuid": "2c5435f8-3550-4cfd-93e2-8185f310055f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369527, "uuid": "44d93f96-3bb6-4d12-a626-e7df0aab99f8", "value": "24576:WAJvV0LWmlFOZxQwyMpfVIFMz9iDlvzAfWD7Tchn3j:WAJN0LWpZT3R47T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369527, "uuid": "c03c3dd0-2e21-437a-92a6-58c965155b3d", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369527, "uuid": "9da904f5-751a-4539-90e4-df2fd17d739a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369527, "uuid": "82eaede2-8b13-4176-ac92-637e2d91747a", "value": "6fad973fdb78b0658af1f962ef1d000631e36bfa34d0c83d0632759805e72852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d772d1d-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340051, "uuid": "ea1e0077-7641-49dd-98fe-6370e89b85fc", "comment": "Malware payload (Mirai)", "value": "3bb6cd6fda610f65fd05741e20306f59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340051, "uuid": "c6c10e0e-082b-48a3-b5fb-1819bdabb51b", "comment": "Malware payload (Mirai)", "value": "6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340051, "uuid": "0573ac74-8424-440a-94da-4332cc213384", "comment": "Malware payload (Mirai)", "value": "2fa81859fc4ff50f43ff16f5cee544f6e84cf5af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340051, "uuid": "9a491184-c6c9-4258-833f-9473ba30fdb0", "comment": "Malware payload (Mirai)", "value": "9a90052a5641fcca01cb763c044b1633dfadba91afc7d952a3744287d6d88ee4d635165ab79be7407de6debccff6e881", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340051, "uuid": "3e95ce41-81db-407d-ace2-5b89360331b7", "value": "T1A0840B88B5F2E2CAD1D4EAB5E319784D3B634336B1D73145A50EEA3312EF14909BDE60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340051, "uuid": "f7380cda-adc4-4881-8a00-4c44eb33fe95", "value": "6144:qhlQa9bNuO3r0eyQg5mBWwcPMxwQuEQjV0HI9c4BoLisRJB9:qhlQa9bNjhBfcjQ/QB0ydOLisRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340051, "uuid": "ca45bf06-396e-4ebb-9147-101b3fee7595", "value": 386272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340051, "uuid": "e2cc68fa-6bf0-4183-aff1-c00f11db2154", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340051, "uuid": "c25eb3ae-aba8-46de-8c0b-8daed48f57c5", "value": "vlxx.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce332be5-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370841, "uuid": "432a1dfc-a8a4-46ad-911b-6d78479a5850", "comment": "Malware payload (Formbook)", "value": "e7d0e9075b3173c1dd62bc1ebd7902f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370841, "uuid": "fc08bdf4-bf62-49d1-bd49-e88ae4b27439", "comment": "Malware payload (Formbook)", "value": "6fca0da799cc63ba982f310d9c0b5e7f4d19e5c4a48fa9abdc60bef6ee0af0c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370841, "uuid": "7604e030-dd9e-4d16-977f-990f11eeb47d", "comment": "Malware payload (Formbook)", "value": "97155fcf0b8034dfa2fbbab67929f9028f88ad32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370841, "uuid": "ae487a3f-c67e-47bb-836e-ec931949be45", "comment": "Malware payload (Formbook)", "value": "3938bcd2f6595781d0cf5ac70b22172ac1acc31cc68c0c0d8fb2bc7f2ab11b8a5eecdd15df4b9325f634f7f2383cd253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370841, "uuid": "0e1fec56-b937-4d00-8c8f-b59406f94aad", "value": "T1DD2523686A0BCD22D9C60BB208B0F7BC46B59DC9D604D3578EFCBED774287067C28995", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370841, "uuid": "e7615a3f-2292-43bc-8696-d54082c25f8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370841, "uuid": "ccd7187d-c2cb-4b2e-a437-860152d102a1", "value": "24576:q/gqGhF6d45HvlmXzRiD0AlLF4Rg8Vl256Z:q/gDK25HtmjR6FF4u8VkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370841, "uuid": "746ab94d-ce0f-4c0f-9b2d-3329e9e1b5ff", "value": 1027584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370841, "uuid": "0794cb4b-bbb0-4890-860d-cfa046d71353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370841, "uuid": "78b3c9bd-f6ca-4726-85f1-c7d887f963cf", "value": "6fca0da799cc63ba982f310d9c0b5e7f4d19e5c4a48fa9abdc60bef6ee0af0c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8ccad5-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786368481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368481, "uuid": "39e59e6b-4e79-4f13-85fe-e8ed0d3b4226", "comment": "Malware payload (XWorm)", "value": "9111e904b37905a4950371178fe573fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368481, "uuid": "6ffd7e79-0437-492b-9493-f0aea147a08b", "comment": "Malware payload (XWorm)", "value": "713a11326d11d660cca496d6a944416e9b990eddb9156f8435dbec0a91bf56d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368481, "uuid": "b4871fb3-3b14-4155-ba59-cb5c02114e84", "comment": "Malware payload (XWorm)", "value": "207b26f60b4c2e08bafbc1376593e08bcd24fbe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368481, "uuid": "430a0788-b6c7-4f9d-826a-1c5e7baf9ca3", "comment": "Malware payload (XWorm)", "value": "77a307ea4cdbc0bd7628324cb1a680aa7e58efe8eb6c865700551b2340245231685f8600db9045c3c327ff848bef6024", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368481, "uuid": "41373fa5-c13c-41e7-9fab-5f96cc83d8d4", "value": "T14A05E0C037397B05ED741A319A75EDB582B92D69B020F9EA1EC93BDB796D2005E08F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368481, "uuid": "057630cf-86bb-4886-8530-a9f5bf2a7dca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368481, "uuid": "62ad44e6-af35-43dc-af9b-59b356fdf65d", "value": "12288:o/PNkwCjLnDCLoeXfaN6er078i+lYjzhJzD8fGhOSCGtvNQaldEzPYd5wi5F:0kdjLDCLFCNZI8iJjzGwLVBld6iwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368481, "uuid": "d8ee03e0-8d1e-47eb-9e04-75a1f78aca65", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368481, "uuid": "50334998-4293-4768-b521-db771bef8b4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368481, "uuid": "b2c8bd08-b69e-482f-b6ec-422326e8938d", "value": "713a11326d11d660cca496d6a944416e9b990eddb9156f8435dbec0a91bf56d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329ec459-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356837, "uuid": "8befb497-e68f-4db1-82d8-9c4148abe50c", "comment": "Malware payload (Mirai)", "value": "9acb39fb86f76ddc4872b653b3767029", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356837, "uuid": "97f5911a-ba31-4ca3-ae8e-09d86c559276", "comment": "Malware payload (Mirai)", "value": "714d96848961e1168accac6cb5c2965646449884061021d5665efc59dcdb0a89", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356837, "uuid": "55e7705b-d0de-436e-baf7-3cba19916781", "comment": "Malware payload (Mirai)", "value": "5c14842e1654e1455034b381e022002b0271efa4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356837, "uuid": "89032c2d-a34a-47fa-b8b9-529d8e60f011", "comment": "Malware payload (Mirai)", "value": "485e96b0482ed3395a9e40b33000bd8b9df7a709cb0b527d28e85be236dbc8d7ce5424a5f13d9c494856c0b16608e7c0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356837, "uuid": "5adf7716-7503-4ca2-a06f-6e2c2e1a5d45", "value": "T1AD142945FC419B12C6C712BBFBAE428D372A17B8D3EE31039D215F25378A95B0E3A546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356837, "uuid": "6c88effc-39fb-44f1-8da4-f4fa079db61d", "value": "3072:jj4gubVgcIlIjOhYYSaEZnAR/De8yaLVEHxalYHtI9P:jj49gcUEa6nARS8ya2RauHm9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356837, "uuid": "a39ee524-daf9-499e-8a4d-7907ad726bb3", "value": 195128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356837, "uuid": "808b21f4-f668-4a98-b15b-0e878a554021", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356837, "uuid": "d71307f3-3ef2-48d9-aac8-e5698170da40", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6101c3ce-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786374094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374094, "uuid": "6169c53c-6c20-4cd0-afae-e486ded7e28c", "comment": "Malware payload (RemcosRAT)", "value": "83b3aeb0e8002a05de9a8bba1375ae25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374094, "uuid": "13559ea6-770a-42b7-be61-269735203948", "comment": "Malware payload (RemcosRAT)", "value": "71561773c4244f38432d45d581f970c80a7e334ea0a18b8f9b575f9a1951e3a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374094, "uuid": "3fb5a703-fee7-4213-a32c-c7adb72696c1", "comment": "Malware payload (RemcosRAT)", "value": "967b28b7cc9728c1502880b295ae5e57aaa66733", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374094, "uuid": "2a317915-c583-44b9-b0c3-e62ebc9c36f6", "comment": "Malware payload (RemcosRAT)", "value": "cb00f68dbe726e271e9e286132a7e868d21eaf670d60c2f79420db11d8bec99b1981003eec370de7e6ecddf1179459ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374094, "uuid": "86e3e72f-420f-4fa2-9d09-4ef7720cda47", "value": "T1ED6512486516D612C9E547B806B6E7B8173C5EEAE400E703AFDDBEFB353AB055C042A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374094, "uuid": "027e609f-b776-4f40-95ce-2de8a9e6183f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374094, "uuid": "9f23d09c-0c08-4fdf-9d68-31cda4de234b", "value": "24576:TeA9s3oiYueS37eqAvjVOccnAPwINj7hhnZ0g5EKUaDU8bDb92w1I9txng3ITCLp:aUs3KDs7rcWnIt7hF2g5LdUyb92RHxWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374094, "uuid": "2d0c6abd-3e9a-4216-8076-2b2c00287e99", "value": 1420288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374094, "uuid": "32edd20a-650f-4a52-a328-032d8ad7c4da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374094, "uuid": "745e10b5-84b0-45e7-a770-71d914838ac7", "value": "71561773c4244f38432d45d581f970c80a7e334ea0a18b8f9b575f9a1951e3a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bea67f-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369131, "uuid": "e170b885-44ba-4855-85ad-8435cdca3c60", "comment": "Malware payload (Vidar)", "value": "bd2173f942f0faf30b1b60aeb9c943bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369131, "uuid": "9d5f1ed8-4b47-47d0-a2a2-26696dae2de6", "comment": "Malware payload (Vidar)", "value": "716cd4fc526b6baeff871d36fe91d282edd2699a4d188c6d6b179670a109fcc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369131, "uuid": "d74146e1-8b01-4130-9780-82f327d64467", "comment": "Malware payload (Vidar)", "value": "143d9d4d447281db7dc1b787779f145746aef87e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369131, "uuid": "9a5be128-1854-42cb-a674-d4676b20452b", "comment": "Malware payload (Vidar)", "value": "13c35fc2c06e3a6e119663ba79e9b3a098677b209c3f406a6adeb1a1abbbf4aaec5b1ad3fd7cfba8d561b61e2c25bfd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369131, "uuid": "24bd49ef-7e3d-4595-ad4a-9ea8a2e0dbcf", "value": "T10152F88AB0D7A0E5D1A6C238D60A1AF7D635705707395FBF47CCC2947BE02502BE9E88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369131, "uuid": "48cee2d9-603f-44ac-a554-8f958ecaf68d", "value": "906e7e2a0725f22826a1dd411058d58b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369131, "uuid": "ac137198-43cc-4831-9f08-74e88d60f3e3", "value": "192:OSur73ZI4KjmDcV4IzCG+evqcpFcRG9UuoSh0om6YhtH7hzv3V:OSur764KqcJWEqUinShVm6Gttl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369131, "uuid": "46737d12-8a99-4b0b-a6ea-cb960f724506", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369131, "uuid": "b37d2fb8-fa83-495b-bd5b-e8e5cc22e8b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369131, "uuid": "f98b6fd9-a2e8-44e3-b313-de36e6020530", "value": "716cd4fc526b6baeff871d36fe91d282edd2699a4d188c6d6b179670a109fcc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f2b44c-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786374042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374042, "uuid": "be94da87-7876-4c4b-a31b-7b84f19c3031", "comment": "Malware payload (AgentTesla)", "value": "af63ab0884c3faea791036c5801ff311", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374042, "uuid": "acd5dbba-1073-4ee5-9e3f-06d25cb5e1a4", "comment": "Malware payload (AgentTesla)", "value": "71ab6ac53c0af815f043a04b31d779964acbe64c4a79cc0309ae8c8840c1a7c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374042, "uuid": "c735baef-af61-4f01-a623-bdb3ba876349", "comment": "Malware payload (AgentTesla)", "value": "1414d100818f6a08cf7ab4b7d96727aa4caf1ce1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374042, "uuid": "dab76590-ea91-4a30-8dc5-98c410a45f1b", "comment": "Malware payload (AgentTesla)", "value": "c787c81aeb030b73d63f89050eb9a81035729c7926a0e0c306b2196b8ee87612803dcfcb7ff8ff3f933aafaad45cba73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374042, "uuid": "05f6a2d6-503b-4827-abd5-c85fe8ba0755", "value": "T14B45CFAC3610F59FC857C9768E64ED74AA142CAB9307D20395E71DEFB90DA87CE041E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374042, "uuid": "ff7530a2-5c5a-46ac-8514-42f7f0525456", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374042, "uuid": "ec97d41f-2648-4d6f-8035-c25e53f1e2d3", "value": "24576:iJieA9sEkO5GOQBV9iZ7lG2BF7S2zg8yVcg73CJULWl:iUsE/QLHw7lG2X7gOGLWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374042, "uuid": "ba7cc3e2-ea58-4574-925e-4eca5e719507", "value": 1197056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374042, "uuid": "dda1a4fd-00c9-4c7c-bee0-3c8b448eedfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374042, "uuid": "0fae74a9-90fe-4bd5-8dbb-6245fd650ee5", "value": "71ab6ac53c0af815f043a04b31d779964acbe64c4a79cc0309ae8c8840c1a7c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883e8b36-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786345813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345813, "uuid": "4f1f4dfe-4948-4e86-bed4-c9b8720174f7", "comment": "Malware payload (RemcosRAT)", "value": "480b14ad50a0ecd80e6178c07461d1d5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345813, "uuid": "3418c711-34c2-4737-9557-5b998ae36958", "comment": "Malware payload (RemcosRAT)", "value": "71bbe25652524477008004b568cb32d3ed5c07693c763fc7ae673060a2e04d1a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345813, "uuid": "8b059290-521d-4646-a8cd-bb21adb4e8ea", "comment": "Malware payload (RemcosRAT)", "value": "02678dbd32a5f23437e39677f0f3ac6a227240d4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345813, "uuid": "d63379ae-72c3-49d4-8632-8231acac5f03", "comment": "Malware payload (RemcosRAT)", "value": "39b4e66d51f4d1349b80a9ae2076992d90b85633b809f610e4cd076098433c0a40508a9dc1985cce7cc3aa0961df80e2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345813, "uuid": "acdcd18c-d489-422c-a387-0ac6071572c4", "value": "T19573A09B291669FFA8578A648700872CEB098701143334EE5F56ACEDC3F4DE740DA9B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345813, "uuid": "80331ee9-0f3f-4238-8f1c-5481abbf62b9", "value": "1536:4E7ytzsydodx6WHEOY4Xvh6cSbKhhS48aqiz99fX3zhyqhlon5gRsrcl/m:4E2tzsydodx6WHEOY4Xvh6cSuhhS48aW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345813, "uuid": "c9792148-4d3f-4189-80ed-3dad8785f9c7", "value": 80204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345813, "uuid": "27c0b9d0-56c9-4f0e-900c-84c7de79a459", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345813, "uuid": "132754a4-fa43-4566-a3dc-79684107bf4c", "value": "INV.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd5ef16-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383591, "uuid": "7ec6c356-0b10-4d8e-802c-c5dea1dad239", "comment": "Malware payload (Mirai)", "value": "b0c5e7b4246bba3e1bbc8aa370032aa8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383591, "uuid": "454bb3bc-188f-472e-a2a1-23603bb58401", "comment": "Malware payload (Mirai)", "value": "71bfd2feeb5a28e09905f136114758abd087bc28d813b47800a1f3cc0b6c178b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383591, "uuid": "500f676f-d97a-4507-bef1-e211f06198af", "comment": "Malware payload (Mirai)", "value": "3d2f7285f62735ad7e7f9a4d92c457b144e3ce9d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383591, "uuid": "7a43cd65-ed03-4130-ad60-be4a71c0f22f", "comment": "Malware payload (Mirai)", "value": "a7ecaac6a0473fd4519be2d324e383f340b7353756f756f42d93e6242d2794c0796459031c39a8e4188305203c65b9c9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383591, "uuid": "049fc064-0789-4e78-a521-3a5e5a37a014", "value": "T167A3122D35109AA2F401C7F8621603B6DA3E18E6F737FD4A85B5AB171AC406D3E2F694", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383591, "uuid": "c77bc95c-e1c6-45e7-97af-3159d8201a6e", "value": "3072:QVFUXqSN0SJkUkcKFrjGdEVPNYKuGzi/tm8xZVEz:yK3JxkHFvGdGYKuGiA8tEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383591, "uuid": "0c8f5dcc-599e-4137-b84e-02313b9b0389", "value": 106596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383591, "uuid": "e231ffbf-bf50-497f-b9ec-fade1ff9b8aa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383591, "uuid": "73a029ed-6147-4213-9f35-ebc88815762d", "value": "disconnectraw.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472453cf-94e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786384359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384359, "uuid": "d03e4ed0-a72f-4fb6-8669-8780d9514a3a", "comment": "Malware payload (RemusStealer)", "value": "ac83d11119f58ce7fbdbe25f70476d3b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384359, "uuid": "1cc214f4-918a-44f9-9844-c1e4cbddbd10", "comment": "Malware payload (RemusStealer)", "value": "721e28946f79f65e9722d27fdb6fb384a3fb747c82b4c8c2f9dffc0fdc6c0a49", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384359, "uuid": "bd3b991a-e43a-4235-b52d-8a3289ca64b5", "comment": "Malware payload (RemusStealer)", "value": "b16decc10a8ee1e9aeddb7ab9015b8d2665bd3ba", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786384359, "uuid": "d436fdc7-98c1-4323-83dc-564a025387d4", "comment": "Malware payload (RemusStealer)", "value": "ec2c73caa8a270749de1c2fc499ba4461132ab4b8532ec913c3784e571f256aadba888bfcc85697f283b79120385c57a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384359, "uuid": "a14de3e0-744e-4c43-9ca1-2360762e3e6d", "value": "T185C65B03BDA149F9C0A5A73188B76252B770B8485B3633D72E90BB782FB23D06D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384359, "uuid": "5a61ed9b-9761-4e12-b5b9-a98da5998c78", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384359, "uuid": "f1b291e9-29f4-4280-a61b-ccaebc4c7ab0", "value": "24576:ggEpkrG06peGzdiqNFacnNdc/USzyPXg8ydHJcyqfMMddYv/oBele5I92ri7tKNn:ggEp0Z6H5icFvNdc5zyfg8qqfMMMIXLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786384359, "uuid": "257b2dc1-4fe8-4970-a8d3-4a4552e5470b", "value": 11879272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786384359, "uuid": "cae38d59-022b-4fb7-9a24-9e9268d26c0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786384359, "uuid": "8773680e-13cf-4877-82f6-23291274f54f", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f20cfe-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371276, "uuid": "5f82acde-8052-449c-8d37-3365ca7b8384", "comment": "Malware payload (Vidar)", "value": "62f2363ed147ffd280bd9e24bda2a862", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371276, "uuid": "46a11cd0-e322-4049-ba15-13cb56b114f8", "comment": "Malware payload (Vidar)", "value": "7223093aa99713197e3e669794d2971953d75e11703b58e359f1946bf1c4e197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371276, "uuid": "8513956b-fea8-43ed-b8b8-1861343d6fe9", "comment": "Malware payload (Vidar)", "value": "51b1d6084925760d07d4fe33f19a4f5cdf38c895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371276, "uuid": "cb29df0c-f888-42a4-aa58-f455849d8349", "comment": "Malware payload (Vidar)", "value": "7e82e2557c7799d65726d2849caad46128f17f897123413700eee975465504b518f17873b122c0bf2c7e7b0634d13d84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371276, "uuid": "9473b365-56e8-419c-a1f9-af70bc399413", "value": "T19E520BCBB1A2B0FDD4EC9239C69F12E3D625308417161EFF96D8999537C369038BCA11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371276, "uuid": "6a8cb798-4a51-4c5c-aadd-5cb771dacf79", "value": "383dd58795248eb99a4152fc6e9be0d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371276, "uuid": "e2a15b14-fa1d-40c5-af71-9a520221705b", "value": "384:BQCeo0EcaThu+Mp1XVwAub0GgcnhwH6lwg:BQY0DqpeXOAuwShjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371276, "uuid": "d25d565a-59d7-4eec-be5a-3f971be457d6", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371276, "uuid": "0fb91175-3f90-4ebc-bd93-2c7eb2f6e52d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371276, "uuid": "60b89b58-625b-4fdd-8763-a74434a67f90", "value": "7223093aa99713197e3e669794d2971953d75e11703b58e359f1946bf1c4e197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760ee906-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373700, "uuid": "43ea7aa9-d0ed-477f-acbf-83b1f4baa1c3", "comment": "Malware payload (Formbook)", "value": "d81411ab7d730c4db3bf5d53f7921220", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373700, "uuid": "9020ff5e-6b5f-4085-808c-d2fbcdb8825c", "comment": "Malware payload (Formbook)", "value": "727a57b900d1a2c8ad8100fe1eda2f0fd4ff0b15297911293b80b396e5c1ea7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373700, "uuid": "cb09bf7b-0aad-463c-a10c-e086e1fadf2b", "comment": "Malware payload (Formbook)", "value": "0858bc368f27606bac67fe340d02bccae9fb216e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373700, "uuid": "ba50236e-7be3-41fc-9172-4112312b3d07", "comment": "Malware payload (Formbook)", "value": "6ce1316e468a93bf72e5484c72ca271a346e74bf92e8b092b705da46a49d979daf96109a59314625163c7e92b1116fc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373700, "uuid": "14b3c4f1-af5b-460f-b428-b0e1fcf73196", "value": "T16835235573A18B02F8AA6FF90AA2F670477AAC8D9550C70A7EE97DDBBD373042401353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373700, "uuid": "2f5e036f-0a52-466c-a977-1d8a0abd97e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373700, "uuid": "65ad5800-8d6a-4810-b0a2-68debcdffe6b", "value": "24576:bzRtpAiofswxbj3wIE2qFGN7JmTuW/FeZ:bzTphwVA32DmiW/Fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373700, "uuid": "b0fd4415-bd18-46f3-a0cb-ac24d3dcb590", "value": 1091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373700, "uuid": "05a21528-2545-4f7e-b3da-80f3cb65cbc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373700, "uuid": "2edb2581-f056-4504-b03f-76ee21f522c7", "value": "727a57b900d1a2c8ad8100fe1eda2f0fd4ff0b15297911293b80b396e5c1ea7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95cfecd3-94f5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786391792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391792, "uuid": "7e1c1941-0468-45f4-b257-192d05aad956", "comment": "Malware payload", "value": "6126efe8426a19f83253a9cef7985652", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391792, "uuid": "18b5e56a-7c08-448a-9565-512415d5e3cf", "comment": "Malware payload", "value": "7280994fe542c284d3ee4c42b4eb5a7b07eb5efc6c8bdce66d5f8ca0316efe5c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391792, "uuid": "0f1c011d-17ac-4f50-9dfa-1da0c93a5559", "comment": "Malware payload", "value": "f99f46b88a6f9ba75e7d0999032935d15552a3ec", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391792, "uuid": "060e34f7-4609-4213-b398-d20f49b44cb6", "comment": "Malware payload", "value": "397576ee8f149a33724674e89208a876d3214e25a714975825804919d76dbafcb2f3aacedda3da104928271c9b2a52a2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391792, "uuid": "a23038ba-a57b-43ee-9031-0499ac38ab97", "value": "T1B4C28D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391792, "uuid": "2a65fa5c-a76b-4c92-93d8-0e2498a5d63d", "value": "768:Y8vCB+25j6es8Rd9FYpMSUpi+20qUpi+20YQX:Y8l25JLd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786391792, "uuid": "52392e78-fc1e-4f42-b2a5-f4d8d130ec38", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786391792, "uuid": "92ae3a52-a46c-448a-923f-8b65b40ee72e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391792, "uuid": "7bdec1a4-4c97-4c93-abf8-734b97498143", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304d5771-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369288, "uuid": "db0992f6-9a16-4d7f-9c12-96fafee5043b", "comment": "Malware payload (Vidar)", "value": "ef63a093f223bfa4b0e80f7f788914d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369288, "uuid": "8c7b3742-6bd4-4f1a-a189-961cb9e77bbc", "comment": "Malware payload (Vidar)", "value": "732cf4f36add7be33afaeac48a7c9ae58dca0575b153a983946c3d308ea1fa45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369288, "uuid": "8227e442-876c-46ea-8767-c905208373fc", "comment": "Malware payload (Vidar)", "value": "b080792920ca1beafb37e24949ce027214512592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369288, "uuid": "adb30c6c-ebcc-4652-a948-44d7e5c0fa17", "comment": "Malware payload (Vidar)", "value": "c6659f092eca2041fe7d5f89d73df060b3ade402f217efe248913200b6918cb3563530498d3c03b5a1ec3abbf832f710", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369288, "uuid": "fde14185-a134-4cec-be50-59422e0767c3", "value": "T1E6923F42E15B52B4C4EBD333976A416726F8BD4122369B3B6FEC9A250D42330F7182ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369288, "uuid": "75d06c36-b9b8-473c-86c5-e61a328393d4", "value": "ec587b6acca52217c3b4bdb530ca22e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369288, "uuid": "33ab2ea7-080b-4348-9243-a0cadf7c293a", "value": "384:OA94pfSj7v02PCPL/XcPwoTTmZS6g54WEwZF0lR9h9alX:z4j2PmfYmZYfGn390X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369288, "uuid": "0515d7a0-95f8-4563-8b79-9dd0a32666ea", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369288, "uuid": "c9e64a63-5ab4-472f-8763-4a945d36d84c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369288, "uuid": "fedf999d-fddc-49d8-abab-ff801075e3ca", "value": "732cf4f36add7be33afaeac48a7c9ae58dca0575b153a983946c3d308ea1fa45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f72100a-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372723, "uuid": "d722fa08-476c-4e25-9ea0-7e79255dc2e1", "comment": "Malware payload (Formbook)", "value": "069eda39e383c1958d0f0a3817e0e777", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372723, "uuid": "30493b6c-9e0c-4921-876a-1197687bf28c", "comment": "Malware payload (Formbook)", "value": "735e61a90cca4a8e265b040b6ed86bc34cd5d298b6d5f9d2fe68dd6aa85b5113", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372723, "uuid": "84255536-8741-4a67-a2cd-a0348cbe7edf", "comment": "Malware payload (Formbook)", "value": "f2233fabc3fa7e2aa388a6fde456fb4e456d5a8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372723, "uuid": "583f536a-6e38-43e6-961f-9d6633c981bc", "comment": "Malware payload (Formbook)", "value": "3f0a4ec8714aec1d85a4e8adcec89317001aae78fa56a8b35e1f3d58599a1bc027840d2e949d108b502d8804fa1bcf1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372723, "uuid": "d3fde46d-ba73-4df9-ac5e-a22f48afe981", "value": "T1E43501242617E802D5D58B77E9A0D37433641ECFB9D3C3966FE96FB7381B3865890282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372723, "uuid": "1db287cf-21fe-4e56-a28d-391cb735053d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372723, "uuid": "c2090d45-8d5b-4578-8d48-32bd0fdc83cb", "value": "12288:+Dxxltnn0gxo954ZJSJOlw8n5sJgOFpXpeXOer6p6OIyMWuIb8pRZga4n9KBpdgm:Mp50EqL8158Xle+er6CW7C312ry3TBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372723, "uuid": "203c3334-3d8f-41a9-903b-b5a6f42f76bf", "value": 1140224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372723, "uuid": "be93e792-0640-49d7-944f-98eac85c1e86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372723, "uuid": "5b87d7f4-a406-4b3b-ab73-8d61edbace8c", "value": "735e61a90cca4a8e265b040b6ed86bc34cd5d298b6d5f9d2fe68dd6aa85b5113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508f5700-94b2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786362900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362900, "uuid": "ef083302-bd15-47ea-81b5-4f64e4f3bee9", "comment": "Malware payload", "value": "7a78946f79afeddcd44f198e6d38ddcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362900, "uuid": "7a6d2709-8c68-4667-a3fe-42ef22dcf24f", "comment": "Malware payload", "value": "73a914cd8e191f234bece7f1e7ad6e82a00388fa8828d94e1a53c8b60e7591d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362900, "uuid": "f2bf04a3-bec9-4706-b7ea-4fcf96ed7350", "comment": "Malware payload", "value": "8574d0703be69313549983658ca0110df96f437d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362900, "uuid": "fa72e576-bd61-4fa8-896e-d61e0352e251", "comment": "Malware payload", "value": "6b9d6b489f3c151e3e6a4ab428b7b691336f8128b4a60db9e65811c933cc55fbdec8fdd832e440d224da397b1520205d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362900, "uuid": "600c30d6-4233-4a4a-84d2-df7b63bc42a7", "value": "T17A353466F2DE0302AE7C3465DC1F26E7D67B010DBEC58DA8BDAA8C81965006D2C19D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362900, "uuid": "45291f87-7e89-4893-b41d-3ba0b63da822", "value": "192:08pc4BV46t4V4f4B8Ds46t4HHV4itc464V46gqttDtDW43IDg84V464IDtibqgRV:HkxdYqAmP6yi9t/hw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786362900, "uuid": "b92c2644-d275-4090-9cbd-5d20f60ba4e2", "value": 1115280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786362900, "uuid": "6b9c71dd-58c9-42e3-a169-b831034bcfb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362900, "uuid": "8c3ad1f0-d025-4c23-8ebc-cf967ae07dbb", "value": "pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75796580-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369404, "uuid": "9849af7c-189f-4d42-887d-96bc965fc2ef", "comment": "Malware payload (Formbook)", "value": "1c23c8ad57e1e72f4797181d9d94850e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369404, "uuid": "21368228-2449-46a6-9fa0-e204fc99d769", "comment": "Malware payload (Formbook)", "value": "73af5029cf043e0c81ebe7258426cfce81c530a92afa74858a978faf2834047c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369404, "uuid": "67a593eb-2f71-48eb-9bf9-267885a9d95e", "comment": "Malware payload (Formbook)", "value": "a6dba20a6a0fec16f34a364ff0fe570292cc385b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369404, "uuid": "de470a95-9237-48f7-b2ff-eb0da02a2a3b", "comment": "Malware payload (Formbook)", "value": "9aea01421eb01fd1f189f675a04c5eb8068dcb95c502282bd0644e476e7537b565cd4d6ad286f055faacf19bae9a6c74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369404, "uuid": "910d7f4a-0983-4727-9aec-1dc62b844f43", "value": "T1E625129462A8CB26E8BA43F15AB1E33047B47D5B7626D31D8FEDDCEB3861B410A14353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369404, "uuid": "016d2e00-fd05-4826-a9f1-23a1f68af33f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369404, "uuid": "5dc1f552-e276-48c6-9563-7aae333f7329", "value": "24576:lECJAB7Z9LZCGhwbD3enYGYqiOz5PFqz2fQ4:OCJABPkGSRFq5PYIQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369404, "uuid": "06d3d1ed-08d8-46b4-b7a3-e021812b8489", "value": 995328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369404, "uuid": "790b64c8-eb33-4222-8b08-819ae7ed3de9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369404, "uuid": "9d636ac5-642a-407e-9328-c823ba2c5823", "value": "73af5029cf043e0c81ebe7258426cfce81c530a92afa74858a978faf2834047c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9156c4c-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786370913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370913, "uuid": "be8f019d-e6a8-478b-87e0-9f297972b4d3", "comment": "Malware payload (PureLogsStealer)", "value": "afb9ab48d2081053f575c484a43ee453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370913, "uuid": "93b9124d-fd42-4ee8-ad04-7762bd1eb341", "comment": "Malware payload (PureLogsStealer)", "value": "73d160235a304ea24fb35c50148512d94c30efd7e701b0fa06323acac4e5f5d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370913, "uuid": "841340ce-2010-4ca5-9686-36be9bf4dd5f", "comment": "Malware payload (PureLogsStealer)", "value": "5512f576ef3889ddd25b9327b1aebd87776ff017", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370913, "uuid": "3f1b9e54-c6f1-4cce-a9bf-cf0a3f1bdc00", "comment": "Malware payload (PureLogsStealer)", "value": "eea271369f41026ac10852f11d7738c7aa27715609fa6240be8f8e8ee3178bedc2aef48ee3beb87f0ba642cfd094a7f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370913, "uuid": "81b17335-3be8-4f46-b7e1-030c68f15ae3", "value": "T13A85E119F29922ECE527C274CBA16632D6B6780607A0B9DF0699D3151F73EE06B3F311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370913, "uuid": "18c5f8c0-220a-49a6-ba39-a3b6088301c8", "value": "77bff2418e99f39a0b3cd60b9e0c1e64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370913, "uuid": "fb9eb5c4-ca6a-483c-ab64-88ee5b1f4ac6", "value": "24576:y+nwWo9aWFq3jQ8nrbM1UHm1TUMuFi9Xkt5ZJiBbOZLklBNkHQtdrMFLAXCK1/c:y+nwWiH4jQPUMugX4udrQLASKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370913, "uuid": "1b3919ab-c2ab-42ce-b681-fb0b37b992a1", "value": 1736192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370913, "uuid": "0f9b872c-7555-4f4a-93b5-70e703d7128b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370913, "uuid": "64cac964-3c8f-4f7f-b367-7fbc475b8472", "value": "73d160235a304ea24fb35c50148512d94c30efd7e701b0fa06323acac4e5f5d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbb80a4-948e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347353, "uuid": "5a56c244-62dd-4842-8d4d-6345cae3b58e", "comment": "Malware payload (Mirai)", "value": "a713d24fa20d1af180b7778aff617cd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347353, "uuid": "1658ef80-f709-455d-aeac-123fb03825ce", "comment": "Malware payload (Mirai)", "value": "73e3159ac2b6f55c2528734df1c7eee06bf68b41ebdd66e00beef77243ee644d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347353, "uuid": "78c7f738-43eb-4c26-8839-d027df748a54", "comment": "Malware payload (Mirai)", "value": "94174acd25997935cd98147fcb6aa32e58fc8b1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347353, "uuid": "72a3286d-453d-48cb-bc29-3ca449342542", "comment": "Malware payload (Mirai)", "value": "bdab235872541dc6fe358ef418b6b35190119d05b63fbe91201f4cc20f15fdba7cc442d1a452a741e28fd12b15ab1113", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347353, "uuid": "e29a1034-fbce-40ad-b6ac-1623a9caebf7", "value": "T1E1A3C84AAFA11EBBD81BDD3705AC0B0234CCA60771583B767574D928F64B54B8AE3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347353, "uuid": "fe71fa65-8695-4b57-8075-06f94da859ce", "value": "1536:RAIu+CSgmb9QfRIQxmoLI2QJfMcKtLRu5BqZD5npHQgsllSp0g:jV9QfKQxRLTQRWHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347353, "uuid": "d91f511e-a551-494e-9b55-2ed452fe6299", "value": 103504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347353, "uuid": "762df302-186a-4c1c-9c53-1627a960a6dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347353, "uuid": "70c82843-bc50-4f68-88b3-42a2f4a74de2", "value": "cCf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8ba872-9473-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786335806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335806, "uuid": "2a8ccaa4-efd7-4362-ad3e-205152d4e538", "comment": "Malware payload", "value": "fd4a298e8e9f5f5de74fb44e91b4a22b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335806, "uuid": "8fa16cc8-e7a0-4965-8df5-060d5f31ae78", "comment": "Malware payload", "value": "740aeea5b11d71914ecabc889848ac1feeaeab299dc22a9fcaa222fe09947150", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335806, "uuid": "0a1f3ec9-e0a2-4889-9133-ec7779fa020c", "comment": "Malware payload", "value": "282fc1cab93fa3c6cf0596bf640a2a9d92557593", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786335806, "uuid": "8d0c9a77-dfe6-4759-89a9-dda32c34be5a", "comment": "Malware payload", "value": "c09620e47dbb4811ed28c49cb3251dd1650894e86882a61961e10219dbbeaa204d1ab6d18134a80ce994e8df6de158e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335806, "uuid": "51e3b3d7-f737-4164-974c-29ff1969efe8", "value": "T10F231941FA53C1B0E19392F008A7C7EA9234DE37505BE6EAEB8D3921FC317418D9666D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335806, "uuid": "72577a30-808d-404f-a208-dc45c49a34af", "value": "768:MmTLC6Fniqy+TE4zS5Q7GMRAgE6BzcEGtlxXPyRSSgbmcJ:nTL7FniHSvS5Q76gJEtYRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786335806, "uuid": "c7de0448-74c4-47ef-91f3-f733c1a41526", "value": 45864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786335806, "uuid": "e2ea36f8-c07d-4c43-ae12-7df114261e3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786335806, "uuid": "a616d316-110d-4286-b094-41f0bed73b0d", "value": "740aeea5b11d71914ecabc889848ac1feeaeab299dc22a9fcaa222fe09947150.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bc706c-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356944, "uuid": "4eab0d2e-c394-4e27-98ae-bb5114dcaf9b", "comment": "Malware payload (Mirai)", "value": "7ef8790cb62f5b52197679c7e4fad9f6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356944, "uuid": "c10190f9-2252-4042-a37c-088546c353ee", "comment": "Malware payload (Mirai)", "value": "742cb99b675080e6eb3b19393aeb9d6d7003233ff8756f052ef119291ad10d3a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356944, "uuid": "c1338cdd-0639-4f8d-bdec-3c5f7a934d7a", "comment": "Malware payload (Mirai)", "value": "9de0f3b8c9e06d3cbdc335e001751729b0070962", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356944, "uuid": "491177f4-729d-4baa-9bc6-f95696317fde", "comment": "Malware payload (Mirai)", "value": "867a0ce53963092497e480108bc4ffe619a2db73dfbbc24e6ab4f20910f69c6ada005787534f79a9f5825c6ddd67776d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356944, "uuid": "e5d21683-f79c-4b8a-af67-61678576a123", "value": "T1E8142A56F8819F15D1C502BABA2D524E37231778E2DF72029E109F74BB8B86F0F3A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356944, "uuid": "db805a85-64c0-4050-9b8d-e0a11bdaddee", "value": "6144:PrN/+9nos2xNzDpbnbufAat+F0Y1yxJ2Q7xWina:jN/+9os2x/bbufAata1yxJ2Qxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356944, "uuid": "a37bc9a1-ce93-4076-a1c2-a2b50a323983", "value": 208948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356944, "uuid": "2a84cfbf-7e0c-474a-815e-71cdec93d627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356944, "uuid": "8d74d6d1-2038-45e5-a5c1-2f02311a3279", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e64991-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356943, "uuid": "616f4af9-9455-4093-9a56-69e8ce107f8a", "comment": "Malware payload (Mirai)", "value": "e606439da8b92a229c1e95cd2e5a213e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356943, "uuid": "7fb1d4a4-6797-471e-9abc-e5f829436867", "comment": "Malware payload (Mirai)", "value": "74d3625c35c6a80392894ac46498df13a158585c8ea39419f5074b4e10cb16c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356943, "uuid": "71b64ba0-8ce9-473e-acce-2808b8b48f56", "comment": "Malware payload (Mirai)", "value": "509d66aad1db909284daf6b7ece9eef1a4d8254e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356943, "uuid": "b526eeed-20af-4c70-9bf4-f37727da6a03", "comment": "Malware payload (Mirai)", "value": "d16e65e79cbd85a92ae79d534db022400a61f1b1817fdb435705a39e889eb38843086003840e00d73a63f43f04c1ec11", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356943, "uuid": "dce42f5a-0e60-4f5c-b01c-1bc761eb621c", "value": "T15B141946FC519B12C6C712BBFBAE428D372917B8D3EE31029D215F25378A45B0E3B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356943, "uuid": "29c62477-5d42-4c37-b2bd-e4892d315f34", "value": "3072:NoO2byE+gBq8daYbJgdnACVtGeYid6bJGiyDvIg4:NoZB+0q83GnACOeYiesiyDr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356943, "uuid": "7a89aae6-c16e-4103-92d2-678c07eea730", "value": 192472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356943, "uuid": "609cdd28-b2f6-4665-bd9c-a486353d2a83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356943, "uuid": "da604b97-5135-4cf7-b3e6-c2b1b5424c11", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8731106e-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1786374158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374158, "uuid": "f5a40fff-b504-4c7b-b64a-634e361fa4e8", "comment": "Malware payload (LummaStealer)", "value": "14853a4ecde96ca24c0dde6f78538add", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374158, "uuid": "82643003-f6d4-4058-9ed0-bd3727f8633e", "comment": "Malware payload (LummaStealer)", "value": "752169cf776cf480fa525852704827f8754e140198c2b4c6e71d7d5283029db5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374158, "uuid": "aad86cf4-c617-43d4-b29d-779bbbdb776d", "comment": "Malware payload (LummaStealer)", "value": "59be6072d23f840e97843482ef465a8d3b94c022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374158, "uuid": "1e248ee3-3892-4e18-af86-9326d3aebbc6", "comment": "Malware payload (LummaStealer)", "value": "fd580912d9dd06dd2d667e672fca168f191a2e7d8bf78aebb07668f6e9ef6b7f684ec5234d16464eff0d87c847f64562", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374158, "uuid": "bce5ab12-01b7-4e86-9595-81a559fa9e94", "value": "T1B4C54A10EDDB85FAE003163158A762AF6735AD065F31DBC7EE483A79EA372D10836709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374158, "uuid": "36210f25-5fc4-40fb-a574-f2254e3cab3b", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374158, "uuid": "bcaa532d-045a-4bfe-ba68-f6aa5ffb50af", "value": "49152:bgyqTt1odqXUtajyA1A8YcTDJLI6ibshUF:cHTt16qwMyANl59hUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374158, "uuid": "1e12dd3b-18ca-415c-9ea7-ee57d4c43c1a", "value": 2642776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374158, "uuid": "f656f37d-1615-45aa-abc4-c9d6fb110084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374158, "uuid": "9e93a709-6462-4b7f-92b7-be08788bb74d", "value": "752169cf776cf480fa525852704827f8754e140198c2b4c6e71d7d5283029db5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52746753-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786371063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371063, "uuid": "891f08fb-f462-478c-b0a3-810a0ea88592", "comment": "Malware payload (MassLogger)", "value": "50b6f864ab6a44a044ea5fbd601c4996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371063, "uuid": "297d624a-9479-48ed-8759-7f15ba09333a", "comment": "Malware payload (MassLogger)", "value": "7522eee0bd9dd853ccef3b37b163c3b3d17ec37d124f1718fbb1acf29c6d162e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371063, "uuid": "ced24f18-b7c5-470a-99d6-1a2225e9ff29", "comment": "Malware payload (MassLogger)", "value": "5a6f0b170756c6a49d7d176af834efa40641b97d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371063, "uuid": "43f934b5-6d48-405a-8601-2b2703dacfcb", "comment": "Malware payload (MassLogger)", "value": "06ed1a020f1cfcc1bb96d5ee6b0a91e4bd6a7449e6ff42e0b421ad2765fae0633419409e9f51e1f094d27ea7795dc6e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371063, "uuid": "8bb26415-1b8b-41ff-9f02-958617716cde", "value": "T180F55C70D351B065D1A7C430CECA0EF4A5A1343B92366D1F1BC5D81A25FBE61ABAD3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371063, "uuid": "7c088a0d-1f6a-4064-a346-ac99dc23acec", "value": "f80b7b5cdfce6ede0a7977b27dfe83ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371063, "uuid": "76b2c7ae-67d7-46ea-b54f-5a994d617fa4", "value": "49152:vThEcMI4sSNJ8dJ0xdFIepAd1B9vbNn6Emft02SLV59MZBbpxUosT2DInj99GQkt:rkLSZ2IenTRDb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371063, "uuid": "69459fa6-33a9-4cf2-ac6b-a866ab0f4b99", "value": 3400704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371063, "uuid": "84e508ab-8a34-4dbc-9443-b737b8ba6b54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371063, "uuid": "fe85f039-248d-4947-992a-d78dc338432e", "value": "7522eee0bd9dd853ccef3b37b163c3b3d17ec37d124f1718fbb1acf29c6d162e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b1937a-9502-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786397375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397375, "uuid": "63853efc-8671-4531-8aab-143f7245b852", "comment": "Malware payload", "value": "4a32b07786a09eee2735eb909bcea0ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397375, "uuid": "127c350f-4da2-49ef-93a7-39cc45c8111b", "comment": "Malware payload", "value": "754ed3c76d7f2150933e134e7fa195d70f465fadcf8408c61634ee1bdc5d3a8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397375, "uuid": "57e49e10-79ec-4dc0-b08d-5f4929489849", "comment": "Malware payload", "value": "2f3265e6951c0c16bc2be051b34ab1d3313dd0d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397375, "uuid": "dd3b4ead-bd8f-44f2-a30d-767b1f0da511", "comment": "Malware payload", "value": "9319c102e4d411b0165a0e791dfb95fd56ca5c37e24e177e359df916400a623afd230a248b915011b4f3e88b18f63d79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397375, "uuid": "1c54c974-8d94-4879-9fb7-124a6774ab2b", "value": "T106A3E70FBC5ACAA2C9969934C37F00512355874158BBAF736ABBC20DD76223BD7179C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397375, "uuid": "402d09f8-6548-4d08-93a5-c0970afc6542", "value": "3072:qeMAG+2391biK/8fVmOUCdYYphRilAtYMw9cMrWu:qey+2nbii8NmOUCdY4qtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786397375, "uuid": "691cf653-7d14-4ff1-892a-774190a6e2b9", "value": 107180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786397375, "uuid": "f2aa596d-a38a-43bf-8458-b33197bdcf94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397375, "uuid": "6d159837-1e64-451b-a307-22e8ad51db8b", "value": "main.microblazeel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f9253d-948b-11f1-bd95-42010a9c0009", "comment": "Malware payload (DCRat)", "timestamp": 1786346407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346407, "uuid": "7d7784cc-7385-4ded-a286-70112a5da817", "comment": "Malware payload (DCRat)", "value": "108b0072f439f8b8e423d814e215645c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346407, "uuid": "52b1189b-e1ff-412a-9758-729dfbbad039", "comment": "Malware payload (DCRat)", "value": "75bceeb7380ab269e61da5b429ed794131f986ec40bbc3f065bcfd71833638c8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346407, "uuid": "93c4be83-a61c-4416-8b3c-3d7e7a727169", "comment": "Malware payload (DCRat)", "value": "fbcf24564eb72125a095d4c4c20dd6e13f1d676d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346407, "uuid": "9d71c31e-ef6b-491a-87fa-f05e4c0ab549", "comment": "Malware payload (DCRat)", "value": "a042fefa4d1d2b535dbca5536f67157765343dbb62b68e02ca4ff7df0c293a258dce1ba3ac638f97d871f56902825ae2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346407, "uuid": "0821d70d-f825-4a35-a59e-214b6d86a704", "value": "T1AE0507027E48CE82F4091277C3EF45484FB0A85166A6E31B7DBA376E56163A73C0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346407, "uuid": "b1aad875-ffc0-4e18-836d-173adda5cdd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346407, "uuid": "5c53646d-cb3d-4ff2-96a8-4eb40f0965c3", "value": "12288:Sjzr4mg5shusXKaRpu+FOTcW1n5n4oJK6UG4jU:Sj3hgKhumRptFtW1p42K6N4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346407, "uuid": "016e5b81-d24f-44e9-a7b9-7adce3eab191", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346407, "uuid": "04f2b36e-bab0-485f-b30b-b1fcde9549c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346407, "uuid": "089325a8-29c3-4fba-a56a-a0f410d3b4f4", "value": "108b0072f439f8b8e423d814e215645c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ca004c-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786372621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372621, "uuid": "e7ffa7f1-7b22-406b-a5af-8e6ae492eca3", "comment": "Malware payload (Prometei)", "value": "ad58b4aafc9369c985c0cf69cc65e142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372621, "uuid": "cab6bc26-cda1-4197-97aa-a3fd9173d127", "comment": "Malware payload (Prometei)", "value": "7619b607d896f36ed8abc4b798765ab11893239c204e7cb60ab09b809da0d477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372621, "uuid": "e248bd2b-1bdd-4002-a8a5-2395d4e1c116", "comment": "Malware payload (Prometei)", "value": "d38a5894e7afacb1bda6c0244a2e3716e76d5424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372621, "uuid": "44b71c09-b4b1-4a7a-ade7-faf533c343da", "comment": "Malware payload (Prometei)", "value": "96996971a5798ba118ac4abf5ee9380f9db874b44c73a492cbc66463bc09693ed35ddce31825711d8d83cc9f8c4739b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372621, "uuid": "9e68b1dd-c0a3-4062-ab13-f92945cd9474", "value": "T19F34BE63A4BCAA9FDDD82F379C4E880713B66FE4D890603E1C44710EFE2A5095F7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372621, "uuid": "c36756f3-f83b-4d4b-95f9-ae0480a7499a", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372621, "uuid": "21081114-5548-4ef5-9fc8-8f26223d728d", "value": "6144:VGxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOn:VG60BpL8jk1FGjDc8GVdOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372621, "uuid": "5847b7ba-8436-4dd5-ac34-db0c6b6f1dba", "value": 245866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372621, "uuid": "c4c00cd8-7284-4c1e-9654-69d80d2f70b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372621, "uuid": "53e0e485-b3da-42d0-a53d-07adb9c0c6fe", "value": "7619b607d896f36ed8abc4b798765ab11893239c204e7cb60ab09b809da0d477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0c7401-9508-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786399718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399718, "uuid": "51fcc1ec-be4d-4aaa-971c-bb2b25557be9", "comment": "Malware payload", "value": "ab75f56e8ba7331dbdff2018a2929ee8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399718, "uuid": "3141508e-f04d-4711-ae58-b3a9558db1c1", "comment": "Malware payload", "value": "7688075202b5fbc5ddecc6bc85cc8606fe30e5bf8bddbe7d3cfafeb0f6f05896", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399718, "uuid": "97fa3560-f7a6-4bc4-a707-4283b0cce210", "comment": "Malware payload", "value": "77c51bad7de26978ac958985d6f843e21cbee2dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399718, "uuid": "88156b89-2065-4f9c-bdc8-3533b3c7f695", "comment": "Malware payload", "value": "94206dd7c843c01cd384ae26200acdeb75d4c7e768b71c76b6335677fc7c590442346b4da63a53be911a2f5b9c238f40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786399718, "uuid": "017359f4-cd19-4971-8167-3e5dd407062e", "value": "T11BD33B767B10AFE6C36CD5300EF28AA54AE6196319E394813365CB1CAE7051D2C9FEF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786399718, "uuid": "8cffd42d-9886-4614-908f-8835be0960e8", "value": "1536:D3EImlpz63Ip80WGQ28+yRqEm7k8Wrf3QcC64/cUUsEB5WZf9JcEQMMS3joA8Vj2:fy64/ZUHB5WZ/QacjPxAQfzXod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786399718, "uuid": "38e91848-40a1-49be-bff2-45f4a176cbb8", "value": 140068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786399718, "uuid": "04bd19ed-36e7-42c6-9704-bb7d0dea54ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786399718, "uuid": "b2dbb6ad-a8a6-4a81-ad31-62448c82042b", "value": "7688075202b5fbc5ddecc6bc85cc8606fe30e5bf8bddbe7d3cfafeb0f6f05896.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db622a15-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369575, "uuid": "f2ee33af-9587-4017-bf08-36159bc643bd", "comment": "Malware payload (Formbook)", "value": "a395871f0aa1c385d46606bf18f037f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369575, "uuid": "6550f0ab-a034-458e-b816-f8709cffcca3", "comment": "Malware payload (Formbook)", "value": "76c453df11371a68c893fa21d2f60b3f5247f38966e304f1305c3e2caad2cffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369575, "uuid": "94edbe03-3f8d-46da-a2e3-542871e14af9", "comment": "Malware payload (Formbook)", "value": "3d1db69b5beacccca13215dae7666c1327ed5367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369575, "uuid": "acfcc229-b9b1-44c6-8db4-a74729b138ad", "comment": "Malware payload (Formbook)", "value": "6e96bf04d562ca43abfbd190906c19fa2e18ba7a62325c0cb34cce93b9007b9e575785b9be5953e00a24a3e0e6f203f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369575, "uuid": "a4d10119-093d-4495-b8ec-d04f361c5dd8", "value": "T1F935014467A8DD02C46A17B895B4D2781B396E09F912E3075ED4FEFBBD777228C0824B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369575, "uuid": "77d1955f-9dc5-461b-af1c-4a10781e4e61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369575, "uuid": "21a7d891-157e-4c36-9b4e-f20241b43cbc", "value": "24576:OAZvV0LINEnFwjzf/9RuNptClFNibRsTUHpG2e:OAZN0Le6FYzf/9RuNpIH06ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369575, "uuid": "10d914af-21bd-4b21-b117-5bf1b2e56bc9", "value": 1144832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369575, "uuid": "25a363ea-4237-429f-9b1e-ebd73b68fbe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369575, "uuid": "661924b7-627d-4f44-9d54-81d670cae108", "value": "76c453df11371a68c893fa21d2f60b3f5247f38966e304f1305c3e2caad2cffe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8107df9d-9506-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786399059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399059, "uuid": "4f3607c2-1dfd-4ecb-8ad5-6908d24bb081", "comment": "Malware payload", "value": "fd26026e9bb0db4318609ec74b9317b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399059, "uuid": "4457ddbc-355d-41f4-b514-aee29e57ca21", "comment": "Malware payload", "value": "76d4b3caa27c65e33379cfd6abd9dd305338530948733ea228d66a74e72c2269", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399059, "uuid": "58f5f030-a08f-4766-8b61-5bec10009dd8", "comment": "Malware payload", "value": "342d52ec4f580686f0daf216167fad4fac091c2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786399059, "uuid": "5a261847-f978-421b-b6e8-123a2dc903d7", "comment": "Malware payload", "value": "5aa74a5b7ef0ba098031a9df9bd728b543975bbca03db7c6a70c9950a003989fe86311650ae49e71d62f84c42b1a408d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786399059, "uuid": "32838bea-924e-4753-8ba2-afbe00df9bbf", "value": "T1B1460797B9925983C5E83637A8BD81C433634EBA8B8752675D05FE383EBE1D90E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786399059, "uuid": "e82296e6-31a4-4bb5-9a96-3cb151e042c3", "value": "24576:+2/HbBcecfpME/Tt9u2vz8Wn9XRNJ0+fFh7rZxaYfDr5K4gJJUgdE4L4amBrRu/d:+rCGm2Z5X7UQDYFnO5tS2SOeMTIM5El", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786399059, "uuid": "7c8c649d-2de3-4dff-9304-38a197e59935", "value": 5767330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786399059, "uuid": "d8e94e0f-42e8-4d9d-9cf6-949a0835dae9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786399059, "uuid": "a391f692-3352-4c67-9416-f8fd76ebb79f", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8d2b1c-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786372347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372347, "uuid": "f0a3429e-a163-4405-a585-1b42ad99218a", "comment": "Malware payload (PhantomStealer)", "value": "e2eac29a3ae14fcd356b78be00142597", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372347, "uuid": "ab13cdca-d619-4f8b-a697-d24a78809f49", "comment": "Malware payload (PhantomStealer)", "value": "77a24411316c52e33e7ae621d6dba7830c01ace413b1a53dd2fcfa3e48695887", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372347, "uuid": "a3c2dd6f-4882-45fb-944f-92d9c9c1b3bf", "comment": "Malware payload (PhantomStealer)", "value": "5078eb6c6c212ca9b0483181b0d51492f7cff243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372347, "uuid": "53d2f736-f025-42ef-9d81-bcbe7d73c4ad", "comment": "Malware payload (PhantomStealer)", "value": "dfe0e2acbcb7aff57e786fa4e8137dd6613b1357674997a40814e96ff3da497766a4cbe1509562ca202cef35f1729b1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372347, "uuid": "626ad022-0222-40f6-8064-c3b0bd04e376", "value": "T15955D09C7250B99FC857CD728A649C74AA10287B830BE24391A71DEEBD0DA97DF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372347, "uuid": "ebae477a-d7a4-428d-89e5-35e13f5f4bd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372347, "uuid": "d641b23b-8860-4276-94ce-a1cac593b50c", "value": "24576:65u+Wj/Og3BGN2viU4arvrFvSR+xBZ0h342XZj+uEirC/iM3zyTAlz1:6IJPRGNCT4MFc+XZqXZj6osW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372347, "uuid": "dbdc3bd5-3b36-417d-bfe5-6822149ec7fc", "value": 1319936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372347, "uuid": "8e186188-4e2b-4260-b7c5-5da4427db589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372347, "uuid": "9f82fbe4-417d-457d-ba0a-66ebe0391a47", "value": "77a24411316c52e33e7ae621d6dba7830c01ace413b1a53dd2fcfa3e48695887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2c75d5-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383589, "uuid": "942a2094-56bc-4fa1-9be5-4f6fb450bc32", "comment": "Malware payload (Mirai)", "value": "bf32078b169c8215b51ba6e1c7e6ade2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383589, "uuid": "8f555c17-7cb0-4a17-a592-99f202c8253f", "comment": "Malware payload (Mirai)", "value": "7826f1073f73991968b774fe7d9514c069e44b4f0477fe2429d5781523806f50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383589, "uuid": "2b299821-18ed-4074-bda4-5b007e2ae30b", "comment": "Malware payload (Mirai)", "value": "05865b355829f5d9dbd795498b8c1f107b811b3b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383589, "uuid": "f2db0e5b-8de8-4b28-80c6-c4790536eda4", "comment": "Malware payload (Mirai)", "value": "1e1bbce941ae8131eb3b91421c53c403efecd7c08cf92ec0c1391a79014ce559c6bf34b3a156ae9370a73472b3d46e9c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383589, "uuid": "1341b82c-abdf-45fb-bf38-105c360b477d", "value": "T188041996F880DE62C6D0267AFA4E429C331317B8D3DA7102CD245F3977EB95A0B3B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383589, "uuid": "70239689-a971-47b9-9bb8-7655a83732ff", "value": "3072:TUt7qbvtcRtQZmYshC/pIgNjtnL873yEyJzEv8Yy+HyH4a:TU8bvtUtMmjhC/WUjtgGEyJzEv8YlS4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383589, "uuid": "6a391cd7-a991-4e47-8b5a-b564fb247055", "value": 173632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383589, "uuid": "14fba752-93ad-455f-a4cd-079322e12015", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383589, "uuid": "322d304e-8721-4747-9d62-6e42340e03d7", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa242eb-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786355624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355624, "uuid": "6aab9950-fa3b-4843-b57b-7ed64bc57be6", "comment": "Malware payload (RemcosRAT)", "value": "4b7cc89e3cd12bca58bf03d6bf8b6c93", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355624, "uuid": "9521d9c0-0327-49b4-ba40-978c046929e3", "comment": "Malware payload (RemcosRAT)", "value": "785b958a455b039014063c61a8cbb67ae22bc2eb7770c464545d0aa7064a8736", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355624, "uuid": "9d91d684-bbea-48fb-ab3d-3f463826f410", "comment": "Malware payload (RemcosRAT)", "value": "acc7255f0f7942aecf0d3df0cafba849b2796932", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355624, "uuid": "3b178529-1168-419e-ac3f-c9f241224ddd", "comment": "Malware payload (RemcosRAT)", "value": "9c5eee7a80fe3e0edb0bf35339d9b3a3e15d523475e7e3c2259808a2ce945bd5ae1b43850e5c296f669253ddb64e3f5f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355624, "uuid": "1e3e1679-b015-4dba-9a2c-20b8b4f1d7f5", "value": "T14D151212FF41997AD54A57320BA770D6D62CFD17EF62890B2301732EBD72BE1C86091A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355624, "uuid": "b17cf544-2e30-4ff3-b552-3c81e247236b", "value": "24576:ObLSv9k7OKYt1QRT/64rmQXVt8eCbmhuFen7i:ObL3OKYtmB6GXVtPhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355624, "uuid": "f9293178-226b-4894-9b09-63c1f1e9ac7e", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355624, "uuid": "562f09b9-5f9b-498c-b4d3-744572607977", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355624, "uuid": "e9de2019-1476-479e-af55-de2366040900", "value": "Invoice Packing List..xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e68d8a-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786372059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372059, "uuid": "38dc3b62-1317-41a1-8847-432e94146c32", "comment": "Malware payload (CoinMiner)", "value": "489cc8b6e89796bfa695402537227ecd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372059, "uuid": "4817f785-42a4-4876-a5ce-7511b322769e", "comment": "Malware payload (CoinMiner)", "value": "78e95ee51ec115dd1dae0085284544d08991b43a39a136e38f2d8fa618693ea8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372059, "uuid": "3ea51cfc-f8fe-4485-a67a-5239fa988df4", "comment": "Malware payload (CoinMiner)", "value": "d2bb2fdd4a12a1deaa28f89d1107197ab51e46ff", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372059, "uuid": "378f985f-0228-4864-9579-5a07754197a7", "comment": "Malware payload (CoinMiner)", "value": "97e90224eb9139d384ca62fdbd07e4960deb6cb41c8642fbd4952fe5a3f2374d104e544ac80b45a8a90122116d9204e2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372059, "uuid": "cf6621e5-982a-4131-8bd0-41e26ae34ca4", "value": "T15D93A7B6B560C1703978C16C678B41506A4A703B355C382474AFB91CBFEC758A1FABBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372059, "uuid": "efb34946-fd38-406b-8338-d2e4ba36934c", "value": "768:6OY4c9t0v50fiAfQO96fKwtgiLgPjUbuK5puCLAqp1BDkcE4zvA4SNtrw1iTDDoN:9Yi0ffmcWpuK5puCLAqpPDkcE4racsEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372059, "uuid": "74a1851b-149c-4dbc-b2f3-5cc33e99d909", "value": 92445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372059, "uuid": "627fc8e1-fff0-44ae-9a8d-865d92bfd81d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372059, "uuid": "f5489c9b-df31-490c-babf-8ef1d8c93358", "value": "install.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb1c766-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368158, "uuid": "ba4fafd2-5a27-4762-a97a-39efcde0535b", "comment": "Malware payload (Vidar)", "value": "9c9ee20bb12d6c75a134a61c5a628d82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368158, "uuid": "d707dd3a-3e41-4722-9308-71b0fefc6e18", "comment": "Malware payload (Vidar)", "value": "796e1b841172a93e58c1ac5cac613c8a24a93254cb5ad363c2273899c6781fec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368158, "uuid": "14df0592-ce9f-4c53-a9e1-c6dd80e29485", "comment": "Malware payload (Vidar)", "value": "b395cb9586fb676942fe435c2d0f004b237e6b13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368158, "uuid": "4383dce0-cf17-4557-a7d2-b1a1d140cafd", "comment": "Malware payload (Vidar)", "value": "f0e7fb65e493987a9198dcbb2a5a680122eb19f9805f0c5033912bd2bef8d5176f15517a10e3fa71f0428392488f0de2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368158, "uuid": "1e82641f-5c4d-430c-bb17-5ff5a776d150", "value": "T117926245E207EAE4C4D5C336A71A526355FD7C6032315A3B9BEDAB3A0D42370E7902ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368158, "uuid": "2c3e8955-2502-42cc-99fe-53559b54022b", "value": "0fcdbe8dc380312e1e50301da9558e95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368158, "uuid": "d0103a43-4fb4-4e8a-8c40-9c497d37614e", "value": "384:O8Fq2ZsQHNuqpn8UTcgf5M1Ie7gg1c4gXo7Zj9MGKjIG9lOL:lQ2GQHNdFhAG5Md7vtbxKjVHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368158, "uuid": "d04d5a7e-6975-4c8e-b178-301e7eca9a31", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368158, "uuid": "136ecf3f-1f98-4eb4-963d-c2d55bcdcfcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368158, "uuid": "02f6326e-c41d-421b-a2df-8b61d37dc7fc", "value": "796e1b841172a93e58c1ac5cac613c8a24a93254cb5ad363c2273899c6781fec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17519c93-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (a310Logger)", "timestamp": 1786370964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370964, "uuid": "ce5b8d93-cb68-454a-8815-4cf19b0170be", "comment": "Malware payload (a310Logger)", "value": "60cb09ed4635e65d83f711013565c68f", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370964, "uuid": "29683d00-fbe0-4950-8252-49a7427adf10", "comment": "Malware payload (a310Logger)", "value": "799ee85a7c9e7c5cf0c30f5edbc3d5565f7ffdb90af08feaf2b3f6cdabf32633", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370964, "uuid": "6cbf45ad-e2ac-43d3-882a-99590c5f2e61", "comment": "Malware payload (a310Logger)", "value": "139e2c2ec4ca86d72935bdecab588a1debe22a8f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370964, "uuid": "62759635-1a15-4a8e-9384-42a7dd08bb59", "comment": "Malware payload (a310Logger)", "value": "01c25d265b854f142c25a70b8a1eeffc10fc542fed05f33adcde3bdf1cd1e39ac615a245785af173b143419f2f2bd089", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370964, "uuid": "5dbd1c1b-70b7-462f-9e28-21bd4773a04a", "value": "T13A944A13EB60A11EF1A389B1B9B5925A68277D351B98EC4BF3408F1A35715D3ACB031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370964, "uuid": "418059c2-f693-4891-84ea-c177fda31368", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370964, "uuid": "99fbfc7c-a770-47d1-b493-609dc4007c1c", "value": "6144:i8d1/w5KA81IJ8GpF6nuTmOOUiBUrjIflBVupeG9+taBX9P4yhDj3Mb:RjYKkJj6GmZUiqrcvG594yhDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370964, "uuid": "96496c2c-9d1d-4b35-b58e-1e5dabd790ed", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370964, "uuid": "9015b53f-e406-4c9c-a236-904f5a9d930e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370964, "uuid": "46913d08-0c44-44e8-95ee-8066f35cea75", "value": "799ee85a7c9e7c5cf0c30f5edbc3d5565f7ffdb90af08feaf2b3f6cdabf32633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3506b87-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372568, "uuid": "e7059794-0f09-405a-a34a-1470adcac532", "comment": "Malware payload (AgentTesla)", "value": "2ca165bea137359e6f2af2f66d59bc4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372568, "uuid": "e43c7c72-7241-49d2-b36b-27bf1d69d338", "comment": "Malware payload (AgentTesla)", "value": "79abf671fb2d8e469a8c3787184244b28584c97b0a004cde920b06c97593654c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372568, "uuid": "1831a5a6-d7f6-4f9c-8dd5-7143bbf1f240", "comment": "Malware payload (AgentTesla)", "value": "b332d60260ff5a491a8f1183ed3eb41e284e2a80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372568, "uuid": "479f970b-5f60-4cee-8f33-69ea17c7616c", "comment": "Malware payload (AgentTesla)", "value": "b1e584021dc483d0682e49debebf5e56e59c8cfdeafc018d65ff097c5c129650c3ce648b852a4d706eb6b93edc1467d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372568, "uuid": "58fcc737-8afc-42e3-9c0e-386148ccc048", "value": "T1D155D045E3845994EDBDA7306636C83147B3BC59AA34D61D28CD3CAB3FB7B825026723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372568, "uuid": "2d4ff21d-51a3-4e0a-a739-cd016a0c893c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372568, "uuid": "0eb3a77c-ac82-4b1b-9b64-da423f67ecaa", "value": "24576:dsOF8HKLZ4e2sAh8cYH1Pq6+e4CAKOE/GeiiO1q:dT2HKtH2t2cYYRCAK/GJi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372568, "uuid": "68874380-30eb-4ef0-b8ce-d04a2cbccafc", "value": 1330176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372568, "uuid": "b45e59c4-c41f-4442-a78e-1eb47317c6a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372568, "uuid": "dffaad74-3c38-4066-8592-80acdfc3b729", "value": "79abf671fb2d8e469a8c3787184244b28584c97b0a004cde920b06c97593654c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ca86d4-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369596, "uuid": "e8866770-8811-4cb3-933e-6e292f5f1785", "comment": "Malware payload", "value": "ab542b3940e50692bbf9b105d7a7524c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369596, "uuid": "d999bb09-21e9-4175-b7b2-e1215d54a184", "comment": "Malware payload", "value": "79f7dff95246ba640daad1753eb0caf9994cae316e54880720c1110f1d05352b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369596, "uuid": "3a2110a3-1324-4d00-8654-b14d7467f547", "comment": "Malware payload", "value": "aa69ca84dbac07ac88e112206dc40a9ba8cd7d06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369596, "uuid": "c8709a30-04ec-4065-9761-07b1d1700730", "comment": "Malware payload", "value": "599dc12435a0bc0db520da1b1339475c095cc325ed2e1a154ef87f0c0e147e9c7ca8176d4789d8ffe1d060df1d800448", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369596, "uuid": "9862ea6c-800f-4f37-95ac-e7543f67bc67", "value": "T1C8A4229DE92113C4F2E4207F96940988796EF22DC3045BD78729A57B1F0A7D019FBAEC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369596, "uuid": "afd69869-7c6f-4e7d-85a2-64eb7af3e687", "value": "801f57a932807da2a7faaa453f83f36c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369596, "uuid": "e35aecab-c468-4240-b4ba-0bf4a344ade8", "value": "6144:PXt/QR/xji0SPqnOmcZ7stNPX4RwcKKafVa/o0gGHBpNogupky/G:/U/0imZotBzf0g0opVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369596, "uuid": "d9653527-dcde-4871-ba81-5ae6ededf1ca", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369596, "uuid": "f99677ed-19d6-4fb9-879d-ba2c04edb604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369596, "uuid": "d50912fc-cafd-4685-a352-7aa66d8e42f2", "value": "79f7dff95246ba640daad1753eb0caf9994cae316e54880720c1110f1d05352b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cdd01f2-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369336, "uuid": "786f15cd-f0c0-4b00-b3a1-df0823039ca7", "comment": "Malware payload", "value": "77927d7f40024ac60210528bf2cf049e", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369336, "uuid": "91f0a276-b68a-44d8-bc8f-81c578dccdf9", "comment": "Malware payload", "value": "7a07f4e25719d0e5f528605949703e63179db70e9522399f3cee8bfed46d7624", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369336, "uuid": "d6dd3d66-fa5e-4156-8c8f-4cec97aa9e9d", "comment": "Malware payload", "value": "786c2c19550f274f65da596b4834270b38d58dc2", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369336, "uuid": "0add11fc-789e-40b4-979f-cace45b91314", "comment": "Malware payload", "value": "f131f3104a8376bed83821bd671bf3f1ac71ca5076f2861861d78a0b24cbac976ec1735657e6816545e6dc97c31a5090", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB4.file", "colour": "#68624C", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369336, "uuid": "ed1bf0ae-e008-4d00-9ce9-21278ea3d358", "value": "T1CD766B13E99588FAC0A9E735C9BB4216BA74B809473133E31E617E782F723C16E75B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369336, "uuid": "415ffd12-5f85-4d86-ac5b-039396186e1f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369336, "uuid": "88f7f6fd-e8d6-4bb4-92dc-a87cdada89d6", "value": "49152:/OE8+4wP8ea7mNouSblIwFLxDI6IMf/FJlyPMP+XefABX9+foNNWOaUAdUWC:/UnbG0FJZNfA/2jUUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369336, "uuid": "0392bb72-b372-414e-8c17-e366374427d3", "value": 7121776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369336, "uuid": "be305f71-1f08-4916-9955-d8ac4d5deccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369336, "uuid": "449833aa-cae0-4dee-b29f-3a8926309c96", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c98271cd-94f1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786390161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390161, "uuid": "22608d3f-ce22-4d30-91e9-67b0c4400a45", "comment": "Malware payload (Mirai)", "value": "5c5415387970ba31a1460e7594b0d9fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390161, "uuid": "a08d42ba-a511-4937-b35a-3fde4743e2b8", "comment": "Malware payload (Mirai)", "value": "7a372f7277fac64975cbb9dea08b66a790396d8997f317987eecb6320e2af4a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390161, "uuid": "c27e4d53-28a4-4535-8a96-18d172834aa6", "comment": "Malware payload (Mirai)", "value": "d9cae663625b4827744ad9d110c32346704f3669", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786390161, "uuid": "d15bcc82-c338-4944-b8fe-53c4685b1414", "comment": "Malware payload (Mirai)", "value": "ee8ffeb4cd1988eafe62a12b2448ec5482b218a0314f2f8f9bfecf35fd141b3d17acf16ddc14edeb72e5277c598d5128", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390161, "uuid": "d1508d4b-0fbc-4945-a997-6e2e3f3cdcdf", "value": "T1C2E30945FC418F17C6C265BBFF5E428C7B2A1769D3EE720399256F20379B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390161, "uuid": "9994bc50-d957-444d-bc86-7e4178238147", "value": "3072:E0e2T3/eRX4sgkQy3ydhPt0OwwqJ6Gi82FrlYqNB4kH+:E0e2T3/uxi/Pt0OwF602hqYCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786390161, "uuid": "fed94535-4473-45b0-a25f-1407ffaa8c04", "value": 146360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786390161, "uuid": "29a60317-f008-4d7f-b877-e591347e3335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786390161, "uuid": "785e897b-3550-4c3d-b0d3-ccc8343c9c47", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808d90f3-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372429, "uuid": "86488d9b-953d-4322-ab90-2adc6cfa0d97", "comment": "Malware payload (Formbook)", "value": "42e898279046868ae8df76543bd5c533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372429, "uuid": "ef4fb7b9-11c1-4eda-988e-6887b175400c", "comment": "Malware payload (Formbook)", "value": "7a616988466313ea0be51292e5e3e1e6078c424c55d17c1d2f2413129916780b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372429, "uuid": "d1923100-bb35-46ee-93c4-24acdcf341f9", "comment": "Malware payload (Formbook)", "value": "d0ffec1796e220df593cf72cfe4b6fe42b7a42f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372429, "uuid": "fca67ebd-0df8-4e2e-b73c-6d5c2ff2bb55", "comment": "Malware payload (Formbook)", "value": "4ac5a91da67553ae42e95a03c1606056614315193e6158bb87d7658b332e85303a423f385319b6bda0e7c5598fb8c994", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372429, "uuid": "54273491-d8fd-4782-a82f-c5705516f8a6", "value": "T16A251294BAD6DF1AD27987B08AB6D0B04772AC2ED421D3074DD9BDCFB6347021918B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372429, "uuid": "68e63f8b-aa03-42ff-9daa-0278956e1791", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372429, "uuid": "520daa4f-6930-46a1-8629-15f1de05df2c", "value": "24576:K4j/Og3p8R1pk9sEte0nK+wlWk644mgdjEyVGY:hPZgSlte0klWk6SgdjjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372429, "uuid": "3a06cc53-a976-4e45-bdad-1d19a16deb0c", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372429, "uuid": "455c6ce0-23a1-4bca-82b5-c96e120e4174", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372429, "uuid": "fa95e9cf-bde6-4ba4-854b-c83f9d087df0", "value": "7a616988466313ea0be51292e5e3e1e6078c424c55d17c1d2f2413129916780b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8924a3-9488-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786344748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344748, "uuid": "e87ef35a-abd1-4be0-aa5f-c28c55dc9282", "comment": "Malware payload (Efimer)", "value": "81ac55ce8354ad51801c5da79b17b88d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344748, "uuid": "bb02ae45-4229-4763-8d6d-51fed708f30c", "comment": "Malware payload (Efimer)", "value": "7a9e33c51367c1f29aca8d70b6205b76d27edd1e95bfb3d6a5dde22d853d3cff", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344748, "uuid": "fc68994a-600c-4fcd-8f5c-b0ba7e4d1e5a", "comment": "Malware payload (Efimer)", "value": "d52e479d1906e3cd728a90196f1139af71bd0133", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344748, "uuid": "6fb17eaa-e9d2-4cf1-be27-0ed5bc3f33dd", "comment": "Malware payload (Efimer)", "value": "27c71bf755e3a16e53dc93006b16133e1fd697a365e81d62847d6b7bf90301096c38a6c8bab06dcc67257c3dd36fa018", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344748, "uuid": "ee32c24f-f0cc-4a85-ab6d-c1eeb09fada3", "value": "T166E6334452D113FFDA73807D6AE016D4DCB1B8B51B32C5CF17D885E29F276E0893AA2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344748, "uuid": "c5e7f577-ca37-46a7-a69f-0ef412914c90", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344748, "uuid": "df2303fb-6476-443e-8283-4aecd6dd69c0", "value": "393216:bGmAgxzrJOiaGFYj9DoRXMCHWUjPcuI3/PGTAI:bGP8JHvYj9DoRXMb8EH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786344748, "uuid": "85b5d243-729a-4275-8c52-1a0dcfa19df6", "value": 14284252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786344748, "uuid": "784e20c0-e8e7-404f-8cc3-e4f6f0c76fa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344748, "uuid": "eca89215-127b-4c75-a970-cc90edf9012e", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4774de9-946f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786334318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334318, "uuid": "eb29b361-dc9e-44ac-a313-310a0d339648", "comment": "Malware payload", "value": "c058f70448dc1e37431e67a6238f1a09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334318, "uuid": "0788750c-4b26-4555-b74f-2a1df4f0dd90", "comment": "Malware payload", "value": "7a9f78520796c234afcb07e3c0d152f82d28fd9ece143f26619815590bd25735", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334318, "uuid": "43225a7d-05d5-4e2f-8f1b-d68a9f07d41f", "comment": "Malware payload", "value": "2c8820ccc1f37da29fcd3fabfdd20b1cb1bfaef3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786334318, "uuid": "148a3c85-063f-4636-81a4-cdf6e92cc4a8", "comment": "Malware payload", "value": "7b6b1d0e258b6e8a4f9d01855fa433620236f9641fa76ff4af959cbaed83c2a84fa0c6a3211a4e700b25c7a3529f3633", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334318, "uuid": "61a14c53-f0cf-4bf6-aa76-245542b9dbdc", "value": "T193632A3A7706AF63CA7D52350FF2CA79E9E0365218E290487342DB1C6E392696C1DCF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334318, "uuid": "7c288805-4c39-430b-ba20-66692f027231", "value": "1536:2rSp697SSwmWELamswOQvuw3SnrUqnrE9WPfvE:7+OmHOQvZCnwqo9Ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786334318, "uuid": "528dea5a-c3e2-4027-94df-e248c232a4dc", "value": 72884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786334318, "uuid": "4eed5472-fa89-4ccf-b17c-b4fe74444327", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786334318, "uuid": "199348d5-440e-40f4-8b75-6985c8e2ca2e", "value": "7a9f78520796c234afcb07e3c0d152f82d28fd9ece143f26619815590bd25735.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcc2bdd-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368690, "uuid": "ca2aaa05-79a7-4ad1-a269-77ea7991e41a", "comment": "Malware payload", "value": "f6e4d2fc174ae73b533ad0e18295f758", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368690, "uuid": "471cf3b3-367d-409d-afaa-17f81b6ff34a", "comment": "Malware payload", "value": "7ad20eb6d7e7ebce52849c426fb0bda4beec610ba06c29a2902e0882ecbd8184", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368690, "uuid": "e2da5048-eaec-4bfd-b994-6b98ec849973", "comment": "Malware payload", "value": "bab93cbd581894d177481fd274d378ba22374d87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368690, "uuid": "73acf1f9-7087-4868-8a74-fcf18b127222", "comment": "Malware payload", "value": "edd9b6539ff0b797605a2f2546481a22704bd13e746a624bd73dc74afb5b8555a603fdbf752c3f5c90eac4d8f126951b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368690, "uuid": "df94cea3-ffed-4dd2-9489-4a411be7c0ad", "value": "T18F741221F961F853CAB4DA32293CBEBA0D7C8F695846632B1F10B6A87D71742550F386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368690, "uuid": "e1c09502-eccc-45fd-a3a6-cf45004ea379", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368690, "uuid": "9fed7e94-dd10-48f9-921d-b0a07c374961", "value": "6144:gGMoidXz0d+jF8s7aiAH0zZHkQey566NDvuIZf6mej:gGsXZjF37aHcWIjej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368690, "uuid": "0ce9d89e-65de-4de0-bc0b-f4f7942c1d12", "value": 347264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368690, "uuid": "4e219d7d-3b3c-4467-b818-7fc0ef8c5301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368690, "uuid": "bc892828-f7cd-456c-adb0-38d4f6c96689", "value": "7ad20eb6d7e7ebce52849c426fb0bda4beec610ba06c29a2902e0882ecbd8184", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6b741c-94b2-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786362868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362868, "uuid": "064caddc-c510-4c46-9248-87ee6324386d", "comment": "Malware payload (njrat)", "value": "df01c944343e4f1bfaa7d5609b2c817b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362868, "uuid": "b0c85e90-6f9a-4c54-b337-628e775e4ae4", "comment": "Malware payload (njrat)", "value": "7ae00fe824c9740db553a800fae168a1a06de02eee3688694f05563a91416f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362868, "uuid": "20c36989-1e45-4d3b-926f-d59f24a3af1b", "comment": "Malware payload (njrat)", "value": "965f9bcc4cdb2fe1ff687324a2d0a2fa9a38ebc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786362868, "uuid": "47dcb2d3-e8ca-41f8-9e95-70c4caa17e73", "comment": "Malware payload (njrat)", "value": "2d8c7d0241fac7b85bb63532539a1c82f7905e74db7a7e4e352dd0cd8772eeb8e65343d4c6331b257c961eeaa66407da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362868, "uuid": "24487698-a9df-44f1-9f73-ad6a6f474fc4", "value": "T132A33A4EFB054A58D16D0EB789E3958802BDD4E7AC27FB7B18D89EF19C628CC854F580", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362868, "uuid": "9e73406c-0655-4bd7-8c66-b4b58ad43be6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362868, "uuid": "4f60ac9c-71ea-4ea5-b4fc-d817f54409f2", "value": "1536:3yatiBJi8YJpKDG5lYDh6Uw19uqodpdu22nMpybnaxOxK4S:rIY8Y/KDDh66NnuPnMcbnaxOs4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786362868, "uuid": "d0e42e45-f7b5-413f-8bc6-3af406656a8d", "value": 100864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786362868, "uuid": "3bc10735-5a8a-452c-95e1-2e3969828bc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786362868, "uuid": "6a1f405b-c40c-4158-a721-27e4c7103feb", "value": "emulator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71900077-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372404, "uuid": "61675338-7a83-4a3e-a0d4-924c1d262c80", "comment": "Malware payload (Formbook)", "value": "b4fdee1d0631824ae370ff694468156b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372404, "uuid": "b4d11999-7dd3-498a-888a-e370fb75c077", "comment": "Malware payload (Formbook)", "value": "7b3b5d14375e2c12836e28bb0d9b277a1207e286f8b0386acec60fe2dced747c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372404, "uuid": "e6b7bc89-bd6b-4e56-9b6d-33b497bdb4d0", "comment": "Malware payload (Formbook)", "value": "6c4373a45f50437b2552f9e6f6239e3cc0707e63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372404, "uuid": "cc742479-3b35-4973-9b60-51d0416b63de", "comment": "Malware payload (Formbook)", "value": "202b574b2d26717dafc5cf011cf514c70ddba1e3253001e562dd4e2d8f31cde118e07b1fc3842e04c99d4c0bb7e701d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372404, "uuid": "79153862-3976-4f93-9141-8c6876b62193", "value": "T1B01522B27369DF19D2B607F44AB6D135A3B67E8DE431D3010ED9ACEB3119B1149183A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372404, "uuid": "1601ad42-690d-488b-8859-5b83bb7cedf9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372404, "uuid": "0a07a9ce-acec-4a6b-aa59-38d2133cc7a5", "value": "24576:HO+L/j/Og3njP5pKH3JIQWS2BT9tXmHQWNUbxsyY:HO+LrPTrKHyQWtPBdVGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372404, "uuid": "5c40e470-795e-4305-bb00-f4dd795245d6", "value": 907776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372404, "uuid": "bbabda32-4ee5-4bcd-b134-85ff080b6e4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372404, "uuid": "b672dcd7-5efd-4cb8-9161-6e0da865f071", "value": "7b3b5d14375e2c12836e28bb0d9b277a1207e286f8b0386acec60fe2dced747c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209963a0-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369262, "uuid": "f39d1c41-983a-4583-ba50-7559eef95867", "comment": "Malware payload (Vidar)", "value": "612b3f77c6483dfa3e3349e7643ac3cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369262, "uuid": "17815a67-64f4-46a3-b8c9-7e481fcb3a7d", "comment": "Malware payload (Vidar)", "value": "7b3b7b94166df2fc604c904765f25067302cf16c53c064d8ecdb01b22a7b8acd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369262, "uuid": "0aab4f67-bd2c-440c-b4d8-8835dfac8031", "comment": "Malware payload (Vidar)", "value": "1ee7f77387bef9f3eb8a4dc82bf6c0e1f21c49d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369262, "uuid": "54dc98e9-a5ae-40a0-b572-1958a2f665e5", "comment": "Malware payload (Vidar)", "value": "d85a3cde330310ee8ef0bccdd8546470b44eb17836c70d4541a28adf77b2816cf63d985fbc875a793b29811129a6761f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369262, "uuid": "c88bd8cc-b4a2-4c59-b679-c36d7839ef85", "value": "T130828386E1579AE5C4E2C332636B526755FC7C102231A73F9BDD6A7A0E52730EA043EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369262, "uuid": "8490b9b1-651b-4dfb-ba36-c74a249933e4", "value": "adc71141eace1722e53258f5f4fda538", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369262, "uuid": "e7957197-281e-4d27-bbb5-b0006cc417ad", "value": "384:OWrv0b80c5rt3fUDua4FeMgt7Bw7v+5bj2Dl:Br35MQeMgvw7v+5bG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369262, "uuid": "973ba936-c86d-4a61-b96a-a1cdc3edd131", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369262, "uuid": "0297b222-a5fe-4c15-81d0-d8c32b43df0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369262, "uuid": "c3436dea-78fb-4232-95ac-fe2b874544e5", "value": "7b3b7b94166df2fc604c904765f25067302cf16c53c064d8ecdb01b22a7b8acd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80aa44d-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370777, "uuid": "63ca5069-981d-46c5-ae79-71ea577c4f63", "comment": "Malware payload (Vidar)", "value": "c758ac951ebd4ff54ea29abf1737c941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370777, "uuid": "0fe58fd7-724c-41a1-9c28-518b448352b8", "comment": "Malware payload (Vidar)", "value": "7b97b1b2cb261ad5c6007ffee856d8ab53d6ebe607a9092f3c9af930c2250064", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370777, "uuid": "b311f8ef-84cb-442a-ad0e-06615bb46f88", "comment": "Malware payload (Vidar)", "value": "2ad311a523856a1e5e65b6fa27a6413ade32a9da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370777, "uuid": "623f8f1c-bfc0-4a31-8de4-514911068a73", "comment": "Malware payload (Vidar)", "value": "8ed3d831d0393c7da5b387a760e67e2aa1921dda4b286c669b17f5de35256ae6eacc45bf9bf71538e3bfaa695ad3558a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370777, "uuid": "c0621c19-fab8-4a9e-b3ee-067cda02eac0", "value": "T19752E98A72A6F1FCD1DC823CD99E17B7CB163089131B1EBF59DCC6646BD320154E8A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370777, "uuid": "12e86cda-62f8-4fd4-b5c4-7ca5f952bb83", "value": "61157f0808e90a1ce9612e876dcb9f9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370777, "uuid": "b2fefd63-2333-44a3-87f9-37a5c149e06f", "value": "192:qxhYMFQYKQrnflp6JmOewswgigqX6Hzu/odUET0DNEzP6+9k88a3V:qxhYez6JmOeaTgqWzugmZDNEb6+9k6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370777, "uuid": "cbf8d676-7517-4e71-9b73-449b529877c0", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370777, "uuid": "3bb303af-0cd0-4441-b147-628cb74ea428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370777, "uuid": "0307b7a3-66b2-42c7-bbb0-97b15de92767", "value": "7b97b1b2cb261ad5c6007ffee856d8ab53d6ebe607a9092f3c9af930c2250064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9dded1c-9483-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786342890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342890, "uuid": "8ef85e21-ac3e-4b9b-aa86-e17ea33f0927", "comment": "Malware payload", "value": "1ee42a45852325b24489c14e17bd2477", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342890, "uuid": "a27c83f4-542f-41bc-8750-6050dff47527", "comment": "Malware payload", "value": "7bb41e811f2107a3182da9090f24893d3612b5b6310194a7dd1f9965ff29e0c8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342890, "uuid": "bb8557d8-f376-41aa-81f9-9aed35df4d4a", "comment": "Malware payload", "value": "b1a6ff3179a0ae87713ff0cb5ec85707596140de", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342890, "uuid": "3e5b148e-6c64-4321-80cd-31b5cfdb5ab4", "comment": "Malware payload", "value": "ac422b765356d8a43d94b9986b6a65dd37e1fb3f8f6e7a5cd32fe6e66218c53fbda982eee017311e467bc16e414e8923", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786342890, "uuid": "529fcac2-a119-47de-9d7d-8438e23faf7e", "value": "T19E73A526788559B425CCDE6C48FA5C50273C900BCA0A2D2CF09EE5D83F76A78F5F92D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786342890, "uuid": "4eef5f0c-bcff-4bfb-81d9-b7344a68a55e", "value": "768:moJjXKfWEDcQPyT9r86roAhF46UwsdWA+jju4:mOEDcQPyTuvb6jGcy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786342890, "uuid": "3f21e09c-a6ff-49c1-a334-474a2b1d6f7f", "value": 77269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786342890, "uuid": "dd6a41e6-14a2-4c55-bdc5-3a041a6c8e32", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786342890, "uuid": "8d3cfbbc-615b-4440-acee-cd382250f3ab", "value": "install.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcdfada-94ec-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786387967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387967, "uuid": "03e067f2-6c36-4a1c-9af9-b401a675c207", "comment": "Malware payload (RemusStealer)", "value": "cdcaf37baf2539da7f88a14b85460cec", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387967, "uuid": "de6c370f-23e6-43eb-ad88-922a799867d0", "comment": "Malware payload (RemusStealer)", "value": "7bd899846f7782027431f3a4f582b166f6944bbc4fdbd86aadd78c248c57f485", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387967, "uuid": "26ee697f-a15d-4999-904c-7d366234f826", "comment": "Malware payload (RemusStealer)", "value": "4d341cd67a487a68ec805bc1c97ab24d5764ad91", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786387967, "uuid": "d30fb471-2a2e-4251-b00b-5e422914825c", "comment": "Malware payload (RemusStealer)", "value": "5699f2cd83054937f09399e1aeea5bd59914163d95612bfea7bda84a9ee393de0446028571068625c5c0e15de1b0afdc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387967, "uuid": "0b0b28ab-5f67-47aa-8a2c-6a5e3c60c33e", "value": "T15DC6230133D840DBD8B15B74C8E7575A4A72FC824B78E7DF12A8A85A2F739D4A431BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387967, "uuid": "2b248349-0814-4fc9-8d89-f85352be06ab", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387967, "uuid": "6456407e-4bf9-4556-87ff-b8af15d2ca32", "value": "24576:lNNpmTB2EV3QHHArllTtl0FEF16+afrOUkNh4ie:lN/m12E2Hg5ZKwAfrOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786387967, "uuid": "1db8a5b7-1735-49f9-9552-ca6e3e953c59", "value": 12582912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786387967, "uuid": "ada2fed6-cd2e-444d-9896-b580198c5f6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786387967, "uuid": "c2165f0f-5248-4b2b-a922-c1512a9bfa86", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21c8054-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369157, "uuid": "336fed62-1bbb-40dd-9780-1a7644681a4b", "comment": "Malware payload (Formbook)", "value": "aece51030f9b0995339f61198ca54d2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369157, "uuid": "82369f41-5991-4f49-bc0c-ba7e1b0d4e0b", "comment": "Malware payload (Formbook)", "value": "7bedc76599718c8e3c1ddb13bc31e0854c7a5c764eecee4026c9d8c88f4559f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369157, "uuid": "e951cec2-2899-41ba-a29c-cbb8fb4474ef", "comment": "Malware payload (Formbook)", "value": "cc074d4e482d98aa73b22cb5c02b158ac395c67c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369157, "uuid": "b904c7f8-02b1-438e-acc3-1a6a3c93b300", "comment": "Malware payload (Formbook)", "value": "3ba90b0a6c374ac2cfaf00b7824bf4330c7a14a0d17cbdef40ad22b0ef63dc8763fd899848efe2ee3461ae5c3f86e831", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369157, "uuid": "bf950f99-f3a6-4293-b01b-6bc16b92648e", "value": "T14E351208235EDD02E0864BB08E71D3F41AB91D98E531D3435EFEBCABBA3AB467445391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369157, "uuid": "e38271b4-b425-409a-9485-c86adb3cda91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369157, "uuid": "a27d1795-158d-4971-9a2a-b790c421c0cb", "value": "24576:ZZkYeJa5Gf5zEKzby9WoasV54/8ZTqkjXuSwhAo0E08SXk1xHl:ZZg8CW9Woasv4/8ZTpulhAo0x9UbHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369157, "uuid": "537fbd08-a008-4431-ae39-cac81e195caf", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369157, "uuid": "7b401d07-6df2-4d5d-b494-5f148699edae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369157, "uuid": "e7e09ccf-bc02-4f99-8b52-6c18780c291b", "value": "7bedc76599718c8e3c1ddb13bc31e0854c7a5c764eecee4026c9d8c88f4559f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c0029c-9463-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786329223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329223, "uuid": "34b9486f-ca7c-4f59-90d0-3446ea713fc0", "comment": "Malware payload", "value": "ead0e809fab3827f5228618a15710e2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329223, "uuid": "368ca55e-a83d-4c77-a0b2-ea3e08b5acf2", "comment": "Malware payload", "value": "7bf7e6decac47c1d1e315a8ef07a83ac148467fda3d6e284870c22c4d500314c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329223, "uuid": "d2941197-a2e1-44ab-b60b-d6a78bcc54a7", "comment": "Malware payload", "value": "f519656a07d56cb8e2edd157a259e24ffaebd243", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786329223, "uuid": "1030e71f-ec5f-4df4-871c-64d90cb8d3a8", "comment": "Malware payload", "value": "6bb1b563ba661e4684fe2394b0ccdccfa52b91cb111c58bfcf1a207a0304cc0d0aeaf1417ee8a54695b08d25c4979e4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329223, "uuid": "6ae15f36-2ece-4ca5-afb0-f61d0843199b", "value": "T147530A23FB0C0452D8D36EB80E7F0BE68315AD5120FE9115750D6F9A1B36F315687BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329223, "uuid": "73e5e8b0-af4e-4802-a34a-2ad79d7b82c9", "value": "1536:CmaT0Yvmt3uyanB+gRy58YB1RrSMH/2H1Aqft18IoME:CXT0YvWehB+we1RjHeH1AK8fME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786329223, "uuid": "83934b8a-60ab-4c20-8569-0c3b71bc370c", "value": 66376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786329223, "uuid": "a7459b61-f491-4b50-a923-321cffaecbe8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786329223, "uuid": "aba95aed-b838-46b4-8a8d-0fcd31cadf6f", "value": "main.e300c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6c5144-9490-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348421, "uuid": "47536fdc-25a9-4bf1-83b8-90d8f815b101", "comment": "Malware payload", "value": "6c5dc5461f9d12b98c2222b9ef00f1d5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348421, "uuid": "c9d11f2d-1cca-4c5c-8f30-b6f9ee49c569", "comment": "Malware payload", "value": "7c102c60e089f5fa941f1abaa409dec4edea90d0f4853020772a3cbc47003afe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348421, "uuid": "50cf82da-ce38-498f-9b74-f24fa15c3034", "comment": "Malware payload", "value": "469356d59f0351e288023ae8766ec9c8e8181f41", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348421, "uuid": "b02e9120-8bf4-45a5-a839-89e63cc93e90", "comment": "Malware payload", "value": "42ce9c03710c0acfc199e9001b65b0a944bdc21018cc02ac8090070acd2ba9f6784137ab4eecbfd746dc14cd79611023", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348421, "uuid": "a8e03054-cdfd-447a-b2a8-5a526b38a801", "value": "T188C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348421, "uuid": "1a17a221-e711-417e-ab17-40f3b84cf598", "value": "768:qi78vCB+25j6es8Rh9FYpMSUpi+20qUpi+20YQX:qi78l25JXd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348421, "uuid": "37f4c2fc-fa10-417b-b677-79e4c04fbde2", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348421, "uuid": "c6426808-6b2c-474f-b971-9e80fdc95d55", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348421, "uuid": "a3f63bde-2dc6-498d-b522-c1f0851551fa", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9453e4-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368208, "uuid": "9cb2e7f6-f118-43ae-afcb-71af968f0928", "comment": "Malware payload (Vidar)", "value": "4420d76f99324330708aa39799d44886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368208, "uuid": "60d85f21-0791-45a6-b689-eb68554160a9", "comment": "Malware payload (Vidar)", "value": "7c3ecd29426f70eef787f2972c9704ca49b42b8f663cf486e888b1c104068ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368208, "uuid": "0857a0ae-130e-4bb3-b11a-409b3dbb103a", "comment": "Malware payload (Vidar)", "value": "62ae934683e98efa764e3ce2be154966e31c4882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368208, "uuid": "f526d9ab-0e43-43df-b97c-25176bb10053", "comment": "Malware payload (Vidar)", "value": "841e742d6e971b8a68baa6821278ed7b8562f0c5b1d4bc34827c80b0b8bd7d77bce45c24be746ca52d738f01668678f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368208, "uuid": "34c733c1-30b2-4624-891b-3ab9c8e6f3f3", "value": "T175826149E217A2B8C4EBC737635A562256F87C4422355B3B6FED4AB10D52330E7183ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368208, "uuid": "454a43d5-ad0e-480d-8e54-332e1b404805", "value": "66ebb7345b7f4b21730e0a314cb2039c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368208, "uuid": "d5899d04-57f0-4e94-ab6f-201e40a50f9b", "value": "192:OdmTwOzXxU1YGODefmO2hUrQ8ZFAtous6vW2g42H8gAdYuiOXxxAYdI1Bpttwp8D:OdmyJtre8Zutoute146P6A3Bp+8Ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368208, "uuid": "c899cb6f-3e01-4b57-a38c-b61618dc3628", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368208, "uuid": "1456bb0f-6327-4ce7-8032-7d0873555b3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368208, "uuid": "1d7d868d-9c18-4a0d-94b8-a1d223ac0b3b", "value": "7c3ecd29426f70eef787f2972c9704ca49b42b8f663cf486e888b1c104068ef1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd33bac-9466-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786330307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330307, "uuid": "4bf1c92d-4e90-4d7d-ad69-a3e8e8775145", "comment": "Malware payload", "value": "52f686b92add93e186abee9bb03d8e6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330307, "uuid": "256b2bdf-a0af-4d22-b356-0f6249f83709", "comment": "Malware payload", "value": "7c49c82d332a3cc49b9248abf3bb01c31309eaadb558e595f64c9dde0512f716", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330307, "uuid": "44d4b404-bd56-42b2-9374-2f75d87045fe", "comment": "Malware payload", "value": "1a7fed58bc4831b6358a02a2e54055b5e141e459", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786330307, "uuid": "76822053-7780-4e3a-852b-a6d6139cd202", "comment": "Malware payload", "value": "58c4e6dcc339b4c63ca779cafda71ea260340bb25d61a5874c3006ed325dbfaab47ec349c9addbf7b8a3e7e728f63265", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330307, "uuid": "7e55a370-93b9-4220-a432-f59e3955019d", "value": "T1E753A3132348BA96DF47AC3F95C7BE117392B994125145A2BB00110FAB76B2ACF0EB59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330307, "uuid": "84769651-5146-468b-8af7-e0c1b91e2773", "value": "768:ITtlo+/JQ/4Yr1EykIl6u4AqSqCweqKUmS7/2MVphVbtoChvoDmfvcN21EzDyHfi:sQyUl4hToDEvcNBfyHdMknrR7Sd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786330307, "uuid": "bc21168f-2ca2-4826-a008-9de5180fcc17", "value": 66616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786330307, "uuid": "75591cb7-1690-47d7-ad65-736cdcf03270", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786330307, "uuid": "ce9c6496-4cc1-46e3-9aae-9e6b84c6fe77", "value": "main.power8le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2e46e0-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369098, "uuid": "ca99b90c-f228-4b8b-b5ae-8fb683c97396", "comment": "Malware payload (Formbook)", "value": "8af0bcc9247c4eefd6fcbc1a1150543b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369098, "uuid": "d7a34672-7d04-4621-bfc2-ea7e41984bba", "comment": "Malware payload (Formbook)", "value": "7c61bf50bf0a1ce3db1a9c33b2121b8ba0e9b6468acf839aed1cef6f7533ef58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369098, "uuid": "2415fc5b-8c6f-455e-a66c-debc601dc57d", "comment": "Malware payload (Formbook)", "value": "909f5b0152936cbe5bd979800c5b53511893a392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369098, "uuid": "81e7d854-2d48-48bb-b54a-57f659f3df8d", "comment": "Malware payload (Formbook)", "value": "0cf3b5bd16234b54760c5591298ad3d0a9fa40bd2ce3cf43a5c0be3a83ea0d8e11240635ad47f2052553d4c5338ea7f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369098, "uuid": "c3e99ba1-bc04-4072-8f23-6a0549fedce3", "value": "T1FB35124422E9CE02D0FA47B05DB1E27057B43E95E862E3574FF2ACEB7C697125829393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369098, "uuid": "29203816-e85a-4f66-8538-fb1e65f1d9f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369098, "uuid": "582648fd-182a-49e9-b43b-bac381047876", "value": "24576:ORZkYeJaAyWoy9KdlzGC75u9EJ6NlF+JwwXQc/d:eZgZoAqlzf74EJ6Nl4JPXQc/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369098, "uuid": "64337008-7b26-4fa6-ac42-421645be01de", "value": 1143808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369098, "uuid": "0e2d940b-283e-4cbf-8db1-863885cb91ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369098, "uuid": "b830bd60-317d-4378-975f-2730f1c655e0", "value": "7c61bf50bf0a1ce3db1a9c33b2121b8ba0e9b6468acf839aed1cef6f7533ef58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74004f3-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370481, "uuid": "127ac415-5a12-44ec-9aa8-cd8dad4d9a52", "comment": "Malware payload (Formbook)", "value": "81952bafdec24c8e08236f1dd6a40599", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370481, "uuid": "c8a4f875-7e54-4a42-93e6-b9fd905a5148", "comment": "Malware payload (Formbook)", "value": "7c999c8074100802e3b9bdc9857acade8aa5352b309cd5dcc40cf0142d357c73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370481, "uuid": "8fb5f084-ccdf-4263-9115-2b918aba8bf1", "comment": "Malware payload (Formbook)", "value": "8daee46b16e62a172d7a3fafff2312fe62d80db0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370481, "uuid": "d520c296-64ef-4ad4-8ddc-c3569abfc2c2", "comment": "Malware payload (Formbook)", "value": "1a8b421111999d6563942d7ce84ff17c34998b8cc19f6c4010181b0ac035d151499c42ee02e6043bd8c82699f6b13d96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370481, "uuid": "529d57b5-1249-4143-afcc-76c00d81f385", "value": "T19C3512503F9DC821D8A26375DC75E3F002F96D8CED22DA175EE8BEB7757250268207A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370481, "uuid": "c9786419-a302-457b-a11b-2a3aa60fec79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370481, "uuid": "91fcd10d-146b-499e-b50a-2e7bd1d2b45c", "value": "24576:/KlCvgWPhe4Wu4p4m6kFndJ60rvPVSH1QHxdzpMgu6WjTBBiALoszMfif8:/KlCvgWPhe4N4pz68HRDNSVQRdSH7dXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370481, "uuid": "d53c8ff8-b0a7-4338-a64a-f83593a7ae99", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370481, "uuid": "bf0931cb-1ce3-45de-b7dc-6ded3040d30b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370481, "uuid": "af29c3cb-ea8d-4494-8491-982b53c5c383", "value": "7c999c8074100802e3b9bdc9857acade8aa5352b309cd5dcc40cf0142d357c73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5664f8e3-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786371070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371070, "uuid": "0f83f235-3c3f-4025-ac97-fc06d83f6b44", "comment": "Malware payload (MassLogger)", "value": "92cc23572e9535432bf32090b3aeb996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371070, "uuid": "3806bd71-b691-4a48-8fdf-dc02f140508a", "comment": "Malware payload (MassLogger)", "value": "7cc720d81f448c7246b761e0213640f83b099e564d32b08cd564a2462680ef46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371070, "uuid": "f65e8ffa-49fc-4fc3-b4c8-34dace620189", "comment": "Malware payload (MassLogger)", "value": "29b18f14448b0ed8a4f7a61035f680b896b76b65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371070, "uuid": "ea046740-9d19-4fb8-b27f-f65759b0a45f", "comment": "Malware payload (MassLogger)", "value": "6b7e23d357d847bcd5bac1a401634590470c60962866797fcf9e0a2f83861b63a1a535f67172c7b14611d3f96570c7f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371070, "uuid": "65ba262c-6334-48a2-a4a0-822a2559d37d", "value": "T169F55B70D351B065D1A7C430CECA4EF4A4A1343B52366D1F1BC5D81A25FBEA1ABAD3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371070, "uuid": "33211272-761a-45ba-85b0-74903b6c708f", "value": "07af236ddfda722ba1d11114d888110b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371070, "uuid": "1ec49710-a8c1-4961-a5cc-758221f7196d", "value": "49152:HZpAWvseJw740jIhG60tSHwFUl0h5+xBn4TZ0ZZcP4wpFlhmD11Udr14nGFHgI:pdTHGTFuUYhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371070, "uuid": "1ddd31ed-6f93-4fc0-8243-73f2603239a4", "value": 3404288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371070, "uuid": "13b589c0-4a6b-4883-a6bd-089b33f1e6d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371070, "uuid": "fd0d67bc-f958-4f47-9663-1337b14211c6", "value": "7cc720d81f448c7246b761e0213640f83b099e564d32b08cd564a2462680ef46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e013c30f-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373448, "uuid": "9b1d507f-8f5e-4c94-99c7-60dce877d722", "comment": "Malware payload (AgentTesla)", "value": "8814659f385137cecd007b99c364f6be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373448, "uuid": "7c03f5d0-9436-48b0-b90f-a402cbb057c8", "comment": "Malware payload (AgentTesla)", "value": "7cde3939faf4f2455e3423203e86e869764d39e78140e52b7acaf36ce4aed513", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373448, "uuid": "f4a98b14-1ff7-4146-8444-108455f23f34", "comment": "Malware payload (AgentTesla)", "value": "4e98fc700f8d3c2cf3a7273cee60d915aff05975", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373448, "uuid": "cdf057e4-f07b-4e3d-98a7-ade682448424", "comment": "Malware payload (AgentTesla)", "value": "3cd97b483a38937bc8b8ce3339204cd3bb82d18b3a0e9242196ded147a95fde46e4f37798548a459b92df1059fda8380", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373448, "uuid": "c608330e-7790-449f-aed0-ef8b4ac36588", "value": "T15C3501541342AE42D4D697F6BCA0D37032B45ECEBAE2D3D29FE52FF734293812954292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373448, "uuid": "1ca09016-1cfe-4555-b10f-872c84ba61c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373448, "uuid": "d40269c4-d264-49d1-8308-2574a962912a", "value": "24576:/Sr9p50fdx+pCPdb8fvNBLlWgJxb3znADbEFKu:/MpuFB8tNBDneQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373448, "uuid": "06a60165-b73b-4348-a47b-1eecc7f6fb35", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373448, "uuid": "7064e15d-b801-4588-8875-4e1645366680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373448, "uuid": "52fb66b2-082a-4e9d-8053-a6ea49c14075", "value": "7cde3939faf4f2455e3423203e86e869764d39e78140e52b7acaf36ce4aed513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35577157-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373162, "uuid": "947eedcd-dd1a-47c3-9fb8-3f701d5aed5b", "comment": "Malware payload (Formbook)", "value": "7059eb13b5798a72f35203d289c56ffe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373162, "uuid": "eefce493-caa1-4edf-a220-8b402291e11c", "comment": "Malware payload (Formbook)", "value": "7cf341abc47c1aff8deccb0f1689e21d98b29218f25540eba47af269e569f1cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373162, "uuid": "4bc707d8-956c-4ba4-9ca2-d3d57918d751", "comment": "Malware payload (Formbook)", "value": "15f7508ea488267a2edaba32bc347087da87adce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373162, "uuid": "ec61176b-cd78-42c2-8e76-558f62779813", "comment": "Malware payload (Formbook)", "value": "56a9aeb2c7e14e747156d40bf3e781f7bccc40177ab6e215d9f9bb7128d78438ba3b3fd710890448703f74094ed02400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373162, "uuid": "a4ae75aa-55a1-4da1-bafb-6b0c70961a8a", "value": "T1F63501541316EE42D0DA8BB2BDB1D33432B90DDF78E2C2925FE56FF778193812958682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373162, "uuid": "f3a5cbee-cadc-4032-b017-70f302107c95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373162, "uuid": "66120d77-d733-4418-b15f-b6cd6b9139ac", "value": "24576:cp50m34Zh+YBwH+xgAOg80DlHnWttRC1jBlTM:cpf4Zh3BwHrsVnWnRC1jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373162, "uuid": "6e9df1f4-e581-4c17-9012-df2d1e20fe2e", "value": 1105408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373162, "uuid": "5dbf63bd-f525-4735-a083-98b73b7ed465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373162, "uuid": "06a7d8eb-19b2-4777-958b-e11b065c8af3", "value": "7cf341abc47c1aff8deccb0f1689e21d98b29218f25540eba47af269e569f1cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d314c50d-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368702, "uuid": "eca5921e-4a8b-4891-b864-2283b3f4b702", "comment": "Malware payload (Vidar)", "value": "6aa3e18f741881f8e0e3b80c3ffbfaec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368702, "uuid": "a33dcaee-7dd9-43a0-b3f7-f866d698a5ab", "comment": "Malware payload (Vidar)", "value": "7cfba22038c53fb14719f65dbd7430938dd14012ecbbdd177c7d6934209997ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368702, "uuid": "4a82a803-c6ff-444c-9376-de88af1907ad", "comment": "Malware payload (Vidar)", "value": "270d5547c47236e269f53b8cec4c443d28474433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368702, "uuid": "fb32e6dd-234d-476e-a12d-e350d8c238b5", "comment": "Malware payload (Vidar)", "value": "45df7dce54b8ba72041872bf78e8efd7de7f8a83e322819142ba1f65347b0c177831072d4cab4c37d57fc9b78e62195f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368702, "uuid": "0e634479-6e47-4aa1-b45b-75ad92d85c06", "value": "T1A642E68B7392F1BDD418C178D9DDA2B7D7063085022A5B7FC9DC8E943F822507678A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368702, "uuid": "6f1774af-3852-48db-94b1-10bfbe494385", "value": "d858dd8b1bbeb55562e1202f74c59e9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368702, "uuid": "a7b79edd-ecec-4bb3-843a-c95c868961e6", "value": "192:OsH4+9rK7k/KqmQZGGreNq0/DGnmfTgw4ywM4jh8A3Vk4:OQ9rKwSVQZ5reJ/anmfT5KVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368702, "uuid": "73f2d2ca-70a2-4e9b-864c-5e105753ea24", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368702, "uuid": "52ccb0c1-e091-4ee5-8175-c270a2b6623a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368702, "uuid": "c7482259-786c-49f1-b307-7a8db9ba6444", "value": "7cfba22038c53fb14719f65dbd7430938dd14012ecbbdd177c7d6934209997ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de81c6dd-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786373875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373875, "uuid": "d49e1c99-f0ef-43a8-83ba-511ce7026612", "comment": "Malware payload (VIPKeylogger)", "value": "1d0403eaaf8fec8795453ada43d6e150", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373875, "uuid": "36550f92-e2d9-4187-bb30-e625e453d142", "comment": "Malware payload (VIPKeylogger)", "value": "7d4267af13461285b1da029ffcbf1cae55d116347d3e9ecdf32dea20aa508138", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373875, "uuid": "0c8ed05e-deec-4353-b87d-039d58eb5614", "comment": "Malware payload (VIPKeylogger)", "value": "a49fe6c9381b11a3eda960065dfa9b67806fa878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373875, "uuid": "3b70f137-8bd3-47a7-ab46-cb118ef4a087", "comment": "Malware payload (VIPKeylogger)", "value": "c555b848067b22245c44698207a90b7d0d7ae05808f46262cf54e7e7f167a4afb40c2e4b49239a313445b1a3bcebd51e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373875, "uuid": "072dd4c9-5aef-4ec4-949a-e44501848f16", "value": "T13674124933E4D5A2D1B3497209F629252BB4FE493395671F17086F2DFE32A81890F2DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373875, "uuid": "64775c64-4ae5-4086-8e0a-7f0f14f78e05", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373875, "uuid": "92209fde-1723-4241-8486-501cb60aa8e4", "value": "6144:tXsKoGhhRZqLleCdJPP5PsotErMam5sPxzC40c0YtjMpXM24FpdVPVnSzX86PHd:tX9hRYlHPBVY/XZe4OUMpXf4FbMXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373875, "uuid": "d2ae3b04-ce56-4b70-998a-f0b7fd95e7e7", "value": 359168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373875, "uuid": "8bcb8a5c-3fc3-48f0-954e-ff541201aa40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373875, "uuid": "c7a48e7a-26fa-4100-be69-f625f6d61509", "value": "7d4267af13461285b1da029ffcbf1cae55d116347d3e9ecdf32dea20aa508138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd42fa6d-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373417, "uuid": "1158233e-bb88-4f7c-9985-735c3f36dd10", "comment": "Malware payload (Formbook)", "value": "58aa3b168a9215ed72e0f4aa46f68c40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373417, "uuid": "9571329c-39dc-4e96-bd30-5766d23ac95e", "comment": "Malware payload (Formbook)", "value": "7d4ca6eefe89648114310a5b13c0134976dc7975bd03a17cc5e397548808d037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373417, "uuid": "be4ee5e0-3628-494d-b6d8-5543075d31f4", "comment": "Malware payload (Formbook)", "value": "62f719ac7c1e43d6960c1dbba3ee490a50ab8856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373417, "uuid": "dacee14f-487b-4dc1-a0eb-702fb35ef848", "comment": "Malware payload (Formbook)", "value": "cb172bf17488b6668cc83346a8b843c448c90ef07644996b31f1144cbd56578d6e9b4384cb058d0ff30bde16c265b266", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373417, "uuid": "82ba9aa6-98e0-42e6-a61a-04a5a9c23512", "value": "T17A3501551312DA82E0D68BB6A8B0D73132791DCF79E2C3D25FEA1FF7392A7C11954282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373417, "uuid": "cb9c0d6d-606a-44fc-acec-3673c6265608", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373417, "uuid": "99c723ce-24d3-4f58-b37d-d17beff2507a", "value": "24576:l9bbp506GIx9sXid0dkUHxdNYXRNWazmyzX4:l1ptxydkUbNY7WazF74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373417, "uuid": "d5f823c7-9319-4df5-99e6-428e0de11a35", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373417, "uuid": "59a7b93a-f7eb-4845-a458-b2bf1a7129a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373417, "uuid": "260ec9e2-bba8-414c-a8e2-853dcfaff150", "value": "7d4ca6eefe89648114310a5b13c0134976dc7975bd03a17cc5e397548808d037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b8def0-949b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786353277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353277, "uuid": "42319d4c-a8ab-4438-b3cc-e073913ac891", "comment": "Malware payload", "value": "6186b6599f00bdb3eb3eff686dda9826", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353277, "uuid": "9c218317-ed2c-4b6d-b774-2b6963403d9e", "comment": "Malware payload", "value": "7d59c3af2ee7b20bbe3acd3237e45f7662c31cee3d2b3c070c7715a799b0ed81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353277, "uuid": "cd5283e9-1b1d-4cec-8b4b-af9ee6ff32f1", "comment": "Malware payload", "value": "0d3a4077cce9c8c93ec8069d8c51615071a0aca7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786353277, "uuid": "9072384a-c0e4-44c8-a52f-0d8cac4db24c", "comment": "Malware payload", "value": "0b685378a23aad0e0e48f04a1ea81822270af94f22cd74caa073b146b8b2c168874a06585b3af8168a9bcd56cbe56392", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353277, "uuid": "d8c10edb-1895-4356-a284-bafde9410115", "value": "T1FD968D13EC9155E9C0EAD23089729253BA717C486B3163D33FA0F3786E76BD4AA78354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353277, "uuid": "bdb74ea6-a77d-469a-b38d-cfa49b5e4210", "value": "98304:uTzOkbNnTSPeEz4q2e7t3adERf4tLFGMmQssAciz76T/YvT0Re01Ks9:uT7NTSPnt/RQTGINAcI7DTcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786353277, "uuid": "47ef830e-2c23-4922-9696-452d68a4e699", "value": 8804382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786353277, "uuid": "cf727ea2-f57d-4cfe-a14c-30e996a56bb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786353277, "uuid": "6c213480-ca51-4a85-bbf9-57920eedbfa9", "value": "jenload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7210c30e-94ed-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786388296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388296, "uuid": "b89d9bff-8c5c-4ed0-b658-3d7eb43df588", "comment": "Malware payload", "value": "4b29a0edf69bdbd712f85698467853d5", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388296, "uuid": "0d53b1eb-bfe2-4fcd-829f-5b9eedd4d7fd", "comment": "Malware payload", "value": "7d8b4974a69380dea474217119954968f3f4d1addd9b60990ca4615cd6cad024", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388296, "uuid": "1b76b9b2-7a6e-4f63-a51c-acff8fb24473", "comment": "Malware payload", "value": "1e29a77696592809c267b02885c3421cbbb943bf", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786388296, "uuid": "9b72e062-d5c8-4658-9d62-a3778fdd9389", "comment": "Malware payload", "value": "b3f0ddd0970a165cc7801010e1644bf167b66a2fcf8f81959383b6840095e99d1de9078ef0c9fae11907783d782ec96c", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388296, "uuid": "c91e6483-c303-4ae8-b353-1378d1b75c3e", "value": "T1D757E7EEA0DBEE5DE410A634A754C44C0C7BBD5A3B12981FB140B77C9236F5660FAB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388296, "uuid": "0003cabc-6245-439e-8cbd-68d1f70e2a3a", "value": "2e6218167fe732516646f6c8da39c0ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388296, "uuid": "a18d6a23-771d-4ba7-882b-988c50f912ec", "value": "98304:6caYfW4p9D99KjAxqehFNj4RlubZRLBGnTKse6DcsfMZK74mPuaDyW0CD6Pfrwe4:HaYfW212ubDQ9mRZlLFnL9DiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786388296, "uuid": "6a9fab58-2900-4c85-a839-4c830d29f8cd", "value": 28152320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786388296, "uuid": "17211cd0-5fcd-4a7c-8cc0-6162bc738e83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786388296, "uuid": "e11db5b0-8843-4538-a3dd-d5bb6b6772a2", "value": "Engine.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb497adb-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372206, "uuid": "d559b254-204e-402e-80bd-237f9213b467", "comment": "Malware payload (Formbook)", "value": "12345804a50b7dfc72ed7920cc493233", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372206, "uuid": "ce8ba37a-65b1-4c25-9750-b72e96a862fd", "comment": "Malware payload (Formbook)", "value": "7dbefbc7163ff38b3a08f73689cdfd0318018854dac6c1640639a7ba50adbad8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372206, "uuid": "7b4523fa-4053-4b1e-994e-1cf705099cdb", "comment": "Malware payload (Formbook)", "value": "b2b8bec330613d6c56a1832dff59394f5d982d1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372206, "uuid": "84b8635f-3fc1-418d-b164-ad1c87d5cfec", "comment": "Malware payload (Formbook)", "value": "a52e4d5e1a5912716ef9927c3352bf6632dd07096b7deff7e677b152e77e0ba145f22fc545f11e424780d96e4f43dc1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372206, "uuid": "b53ae0fb-5830-4d55-a294-9bac56907c52", "value": "T1FA352224969BC923C5966B72D9E1E2B013A58E4DF213D34B5BECBEE7B8333871452341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372206, "uuid": "fa998f70-653c-4983-83ce-704c61a4a643", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372206, "uuid": "963587e7-5158-4dc8-804f-a0b0533e2133", "value": "24576:+RsCbEWmM0UOk5qogfEobyG7Rh+LK2ilzUoI1Ah9dKwiGotEZYIxO:ATJ0JogfE8yGKW2ilAoIO3dZEEZ58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372206, "uuid": "c88acf85-6615-47af-9a90-6c0a7629b5af", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372206, "uuid": "013558b2-87c1-4fa3-8764-c1baa7423ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372206, "uuid": "246c735b-89b5-46ca-9f7d-53254f397674", "value": "7dbefbc7163ff38b3a08f73689cdfd0318018854dac6c1640639a7ba50adbad8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9083b5-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372186, "uuid": "e90e102e-c6ce-4da8-acda-eadadf561e21", "comment": "Malware payload (AgentTesla)", "value": "d0dda77051593099b45df65ec0704de5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372186, "uuid": "5dcfdb4b-c3c1-409c-8f2d-71f1e39f595c", "comment": "Malware payload (AgentTesla)", "value": "7e3ac5d4a03da314042ab3d2015918751558676c0ae50af1121560080a304e84", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372186, "uuid": "f81b0c9d-e72a-4c87-8788-3e8f9e729bbc", "comment": "Malware payload (AgentTesla)", "value": "d88d9c27466c4000b0c737c14329089cdffa2852", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372186, "uuid": "444364ae-5635-48df-b7b0-5bc423ad31b0", "comment": "Malware payload (AgentTesla)", "value": "b8c7a20987493de95e0317b81f4a1009d07777f96f952de3b496412aedae2c13e015d9e901a0815c4def80c0d5ed6afb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372186, "uuid": "4ef5a784-07c0-4e53-bdfb-f16c49af3e7d", "value": "T1CC25E01927E85B68F9BF9B79447805114BF6F806A773DB6D7D4840EE1E22F808A42733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372186, "uuid": "74dd7f06-f1e7-477f-8794-3ac6822f129e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372186, "uuid": "980b1d31-efaf-4b38-a893-fe86d3e27698", "value": "24576:LOC1gyncn7oprP69WQXy43iEZ/PPih+e4gFhKvQFOL01:3ckZiri43iGiMgF0sOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372186, "uuid": "4929eb07-578f-481f-b11e-ac9c42f6a984", "value": 1031680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372186, "uuid": "22f46944-f171-46ae-b117-c4c84091dba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372186, "uuid": "0587db96-7bcc-4bbb-be7f-c92ddf3d1bf2", "value": "7e3ac5d4a03da314042ab3d2015918751558676c0ae50af1121560080a304e84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15a2fa9-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786372108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372108, "uuid": "d040b066-3c3a-49ca-9b5e-64530e89142d", "comment": "Malware payload (Vidar)", "value": "e58b7c4357e53a5892aaf0ca2ab0a2ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372108, "uuid": "59162287-bda1-4f62-958e-602ae30562cd", "comment": "Malware payload (Vidar)", "value": "7e490d8ea84c74a17042cd9b343584978ae1f1fb448509367d5d1ae6e2515c31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372108, "uuid": "ef43b34c-6454-4b67-89e3-cd4004b6f4e3", "comment": "Malware payload (Vidar)", "value": "2808bff452c9744e3e564d5e03ff574006c65956", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372108, "uuid": "9de95ff8-f9f5-48d4-8f77-0f3a04f3e73f", "comment": "Malware payload (Vidar)", "value": "45909ba8a939c3c8807e867f26fff6857c052833a33189818fe72cdb6f807f67752eac35eaf9b6669bd312d7b5984b1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372108, "uuid": "d805f147-fc00-411b-b4b8-05563e08df2b", "value": "T17D5207CF31A260BDD0B9C33ADBEB1AF6CA66304516166FFF46ECC5542B4351029BCA11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372108, "uuid": "b6969e5a-d135-4ae5-aea8-1d339b22f1bc", "value": "a0e569ced2b379a4afc970642c7a53ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372108, "uuid": "28eb2931-3705-4e93-9954-a62940b4a7aa", "value": "192:ODVlUV+Aa3DVIRXbFZNURVhXBw0PrSehXUosdA55FanG9HY+fz3VQu:O++A+DoJYTJqG940zlQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372108, "uuid": "acd0f400-ef0f-43c7-9d20-c139944a8830", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372108, "uuid": "8581dd91-4f2d-4f8f-8a9d-114c787050da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372108, "uuid": "2dc9dbad-d924-4002-81ae-351fc72c6db3", "value": "7e490d8ea84c74a17042cd9b343584978ae1f1fb448509367d5d1ae6e2515c31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32eb53d6-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368863, "uuid": "91261f4f-c001-4bbf-a78d-2d1cf13cc774", "comment": "Malware payload (Vidar)", "value": "b42f91c93926dc64a227b8f44fbc33cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368863, "uuid": "158e4645-959d-4b8f-b357-c87ccc18ac46", "comment": "Malware payload (Vidar)", "value": "7e938d2be8198c194649447ce409f5e05bcf498350bee69c5867aded464a430e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368863, "uuid": "2e240bfd-56ac-45d1-99fc-3e646f1bb6c3", "comment": "Malware payload (Vidar)", "value": "04a0f2f1b8411e0dd09c8316df83b37a7c7491c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368863, "uuid": "a02c90c4-a1cc-48c8-9870-b42d967e0af8", "comment": "Malware payload (Vidar)", "value": "5a833255760d2fcffc8296bfc56d341a322b94a2a763cd7ab39aea66c97ef46743dc3cf7fd868695a0850388b0117a93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368863, "uuid": "15bc8422-0465-4386-952b-0677986c879e", "value": "T16F621AC6B09370A5D0B9C33ECB1E02E79AB6305607376FBFCAEC4594268352175AC762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368863, "uuid": "e6377b25-4669-44e5-bf0c-16df98265075", "value": "b94dba3155137e594dceb5b549504f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368863, "uuid": "3fb1e2e1-e2e2-452b-b9dd-bc1189211551", "value": "384:iM+v4jgXLqeZdJrLN6wZOw6zjWxPFEkJadGli:NK4UnJrjO0NEkigi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368863, "uuid": "b50d2d10-900c-4866-9837-e2b179052d4b", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368863, "uuid": "ba747f52-3531-48ce-96ff-c959bad1ada1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368863, "uuid": "6a5fd49a-590e-4ba2-bb63-14e23a7c8292", "value": "7e938d2be8198c194649447ce409f5e05bcf498350bee69c5867aded464a430e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5457360-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786368330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368330, "uuid": "616f0853-db4c-4ffb-aea5-7f8ad9973f7a", "comment": "Malware payload (AsyncRAT)", "value": "d20199e17a8b82f032f552babce01188", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368330, "uuid": "058fb519-2e62-4476-97c1-e2631ea8e2ac", "comment": "Malware payload (AsyncRAT)", "value": "7ed128f60606e48e519f0da9d8f412944e13bb24b7f47e2a8222ab84dd7e6093", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368330, "uuid": "ac24a39a-a9ce-4083-a9d5-9998398b9c26", "comment": "Malware payload (AsyncRAT)", "value": "55e4eb933dc40106a31210ec879daefd5ebbaded", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368330, "uuid": "db97342a-a4a0-4e3b-86ed-9c67c5b6a94d", "comment": "Malware payload (AsyncRAT)", "value": "2bdf61eb3a725e86071b91f1e56221821a6e874ad7deb21f3f88c08e33e37cb14de96f79a04b49c660f21e4309d48f7b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368330, "uuid": "2b5b6163-8b0e-4b81-a5da-2571706ee2e8", "value": "T10E05E0D03769BB05DEB41A359A75EEB543B92D68B424F9EA1EC93B87746C3009D08F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368330, "uuid": "c8baf1dd-acbf-4451-9d0f-cd8d56823180", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368330, "uuid": "7c22361d-8cbb-4edd-a84f-3ade09e23370", "value": "12288:lBSsGy9Zj+2y6wo6QviA5SP6xYInUQSTkvGHt5XU7tfUamrmD/PN:lX9Zqob5SP6xYASTkvGNIlTmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368330, "uuid": "75647822-a22f-4816-a29e-7309a0d0500f", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368330, "uuid": "3c539d90-29b3-4fbd-a982-acaa4ddc5478", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368330, "uuid": "40f050a7-d158-4f0e-98b7-9179c3384e27", "value": "7ed128f60606e48e519f0da9d8f412944e13bb24b7f47e2a8222ab84dd7e6093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ec03f8-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786345975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345975, "uuid": "6bb796cd-65de-421f-b60b-fb35191f02c8", "comment": "Malware payload (Formbook)", "value": "34811e91378f09d0434cdb184be90fc3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345975, "uuid": "79bed86a-d026-49ee-9830-2d4c6d651d43", "comment": "Malware payload (Formbook)", "value": "7eedcabf7e36a3967453ad9ce0ae52dfc0098193fb6ee164bff8a79fa9038cf2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345975, "uuid": "dbb96d7c-0789-41df-95ff-29b7fac64cba", "comment": "Malware payload (Formbook)", "value": "12fffc768dfe68fd2bf3c8c9cfe3a56998301b36", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345975, "uuid": "17edd4b6-2271-4137-8bbb-91258bf30ae9", "comment": "Malware payload (Formbook)", "value": "23953296f52937106a12268928e427bf64cff9226f563c5e0d7b75fe2dbb8c4df7db3103260634281017b75e992b582f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345975, "uuid": "e9646b68-42bd-4b2f-a1e7-806e6e927a63", "value": "T1BFE52980974895B0AA2DA72CD1379E240A1FB04361C5EF1DB67C7A4873A6F5F638DCD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345975, "uuid": "e0662060-7949-44c6-bd56-6c4835be8a86", "value": "49152:VoHkPgiQciRQ+EOHIwZnVMZ+lbNgP3Qk4yJ1CzjZEDQZuVpYa9m7CNKEUWMzCAak:VoEPXGq+TIZ+lbNgPAk7J1CzjZEDQZu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345975, "uuid": "38d9eebc-dfe4-4401-894a-d4baf9bc8451", "value": 3090730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345975, "uuid": "93437417-d805-4708-aa91-f9bf8624d1d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345975, "uuid": "299404bc-1829-4cc3-9fc5-61135c3e062c", "value": "XScan09082026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d20e8ea-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370330, "uuid": "b9f8d4c8-2b8c-4b32-a893-22de7803c240", "comment": "Malware payload (Formbook)", "value": "c094b336c141a5f548d2174b20e46980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370330, "uuid": "92fb64e2-38a2-4925-9ca6-9ddacab273e7", "comment": "Malware payload (Formbook)", "value": "7ef400cb3e8277e921f82937f2abc8267b30096a150c706a6891f26d4dce50b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370330, "uuid": "23e07de2-2a2a-45dc-92ae-be6ba61839fa", "comment": "Malware payload (Formbook)", "value": "4b04cf8321f1297daee321bc6da1a0fff50c5bb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370330, "uuid": "389cc111-a59e-464f-8d11-370416ddac95", "comment": "Malware payload (Formbook)", "value": "2892762a4e37b522564be91f4bb3309ef82375e294ff081f3c63b1ccbc2b6f00a9eaa81e8294f01e44c56a1978bedd61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370330, "uuid": "64c7a271-d981-4bda-97fb-2904b5ee8e9e", "value": "T12B2512A4AE0ADD21C9935B74C9A0F3F512B54E8CE910CA139DFDFEDB7C3A41B5818582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370330, "uuid": "25e49d16-39aa-47ce-9759-092a5d83fc67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370330, "uuid": "c44f6f12-78cb-4014-852e-17e8596b6e14", "value": "24576:lpY/5gXYo8GtdOxQUWFWKCEn+yY/t5zwzsv8TCH6/pe:lphYCOx0Ywn+R/Dczscw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370330, "uuid": "82425260-1d9f-4b8e-8f76-45ba5cbb17e0", "value": 1037824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370330, "uuid": "f010066d-a129-47e4-ac92-7b3e60b8712e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370330, "uuid": "db308733-8145-4a0a-8fda-435982aeacca", "value": "7ef400cb3e8277e921f82937f2abc8267b30096a150c706a6891f26d4dce50b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26263a52-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368412, "uuid": "a9f8898f-4a12-4835-adf8-feb6d1779ce5", "comment": "Malware payload", "value": "9cd31d75ad633e646f028a9da3b4307b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368412, "uuid": "5932a1aa-8245-4c2e-9d20-d7174b10ffb8", "comment": "Malware payload", "value": "7f0010cb0fa3f2a8402ee436b7fa464240cf77827d1e71197ef8e24e1cb17418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368412, "uuid": "4c0bba80-4f01-4f28-9bc6-d6057a600661", "comment": "Malware payload", "value": "d060b3863e39437bcefc179badbb7f6ed17f6ccd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368412, "uuid": "ef0174e5-c0c2-4d52-a050-5bbbb924a66d", "comment": "Malware payload", "value": "e6c72322bb759b03044d868459b3ddadf0a393d5a3f433c10f58a35de8a04f4a01da027c3de8e97dece058e9f4730ab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368412, "uuid": "2390d6f8-379c-4ee1-8318-d9a5aae895f8", "value": "T1699412680D4541D6E254813E114F06ABB874C8959BDBB9E37DE7F033ACA8BD72D70AE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368412, "uuid": "598d6f9a-de18-4894-91fe-dbe64e7095e5", "value": "64b1a2d70787bddac00e22c6a90626f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368412, "uuid": "76da1f05-0222-423a-bde9-82249e900889", "value": "6144:SPMbFMqstTwOTBKCfk02xwimYeomuAKJUzi8VKcNSRdzsBco:SYFMqI7KCgxnbeocpNCz4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368412, "uuid": "26fca0aa-8628-45ca-b005-85bd798b43ea", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368412, "uuid": "093a263d-7e0d-4578-ac33-21e2e4b61e77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368412, "uuid": "4651c596-0552-49a2-aa10-78587578e0ec", "value": "7f0010cb0fa3f2a8402ee436b7fa464240cf77827d1e71197ef8e24e1cb17418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09158be5-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371799, "uuid": "b826510d-dd56-4b60-9727-f4be246368d6", "comment": "Malware payload (Formbook)", "value": "abbe775e6b0e3466de5e380ef4dba4bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371799, "uuid": "28f25dd9-2615-48d9-8221-0c631a9c3264", "comment": "Malware payload (Formbook)", "value": "7f15f5aff1d1265727e043a758440029b6fc3d52e2a3ba748916c86575f886bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371799, "uuid": "46680495-229f-4037-b0a4-b0125a066dc0", "comment": "Malware payload (Formbook)", "value": "7bbb78b86b086d17288b37f98271753b2e776a7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371799, "uuid": "dc3674ff-ec43-4ab7-9183-a02508c3a496", "comment": "Malware payload (Formbook)", "value": "196dc16e82e7f3cf886963b3bd26d9e86fb88488347d7e4efe17b70bbda3f5beea5c3773aa6230645a21b7469c636455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371799, "uuid": "9d9e69a8-1060-4b0c-9839-306cd9cc7cb5", "value": "T144252268A617E90BCA19A3380BE2F371277D4EDDA500D2239BED7DFBBD65A008C405D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371799, "uuid": "3e9d2228-3005-4c2e-aba7-6cfb20aa51a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371799, "uuid": "b67f87ba-0f79-4863-80a8-166b2dd7efbc", "value": "12288:TlJdbZ9G4B07NBaS429soQHRTv2f+DexCVpSGrQBDx1b5N+zyUl5fDeIQ1oVOBQt:TIG0xwDGs1ZCvCjQBpN+zyHhQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371799, "uuid": "043c54a1-2c6d-41fd-af47-e13ca3dec7c2", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371799, "uuid": "38894bf2-7c0d-4c29-9e0c-00d6e2054e7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371799, "uuid": "1615a2ee-8ad3-4c69-ba32-4a83c1e8f6a4", "value": "7f15f5aff1d1265727e043a758440029b6fc3d52e2a3ba748916c86575f886bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f638e91-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372884, "uuid": "0858aa6b-99b1-4da5-8693-4d183a4cc977", "comment": "Malware payload (AgentTesla)", "value": "3907b8303c170ed6688ae210ada0fce7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372884, "uuid": "92af223f-a0f3-4504-94ac-0eaac6af0ee9", "comment": "Malware payload (AgentTesla)", "value": "7f3c03d419eba8e6dcacd203e3285496cd13ef5f26a88e6d744c16324c6d4307", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372884, "uuid": "5843e737-5aec-46b6-869d-3c1f18b6985e", "comment": "Malware payload (AgentTesla)", "value": "d5a56b545e5c37f03cd2249470b6d75d0ba4f854", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372884, "uuid": "0d6b33a4-9116-49f1-b05f-09389a4ac6dd", "comment": "Malware payload (AgentTesla)", "value": "1cb77e846263e829afe3f7ab0e52d94cacf7ab02c0e19bf425d3cccf2b0a1e6e229f78008537dbec218d711d38171071", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372884, "uuid": "85b79bc8-0554-46fa-969b-7f03ce6f8bca", "value": "T11CA4F1057B00E412D6674336486AD7B40770AC619E6DDA5BF38C772E3BB33969B1A343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372884, "uuid": "f6146a3e-72f2-432e-9be0-574629bf6c98", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372884, "uuid": "8069fb62-ce92-4b25-909b-50323f7fa321", "value": "6144:afY+onBfgb8Cid567+Px+1Z8MeW01JYIyVeuV2inqWnGH6shirKDGzCW5uJ1:afYFFn0wx+1mMxP/e2ja6shmEgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372884, "uuid": "846e95f0-73c9-41f3-8ce0-ed783ad2f7ff", "value": 477672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372884, "uuid": "6ad7d809-ab65-45a5-a51d-2e580abcc42a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372884, "uuid": "4422404c-0b82-43df-bb1d-5f68de8635f0", "value": "7f3c03d419eba8e6dcacd203e3285496cd13ef5f26a88e6d744c16324c6d4307", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4bfb425-948b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786346371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346371, "uuid": "088cf588-5f8d-4768-a5b1-16f7257dae07", "comment": "Malware payload", "value": "4aa6adb760de342fdb7d03b5329002c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346371, "uuid": "14889c42-3829-4f20-b362-8ba1bfd08283", "comment": "Malware payload", "value": "7f7c6902723ab6dd3d07d7fb1e20fe4cb3dd7cf3ede2c143c633f40e777f3816", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346371, "uuid": "a9324c0d-d45b-4823-977c-0e0c9a425c2d", "comment": "Malware payload", "value": "680aa0046fdfbeb1b334614132c07c82532a9830", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346371, "uuid": "6b8b1e9a-b59e-47aa-ba05-69b8774a6df2", "comment": "Malware payload", "value": "3d59a7f71cccdac128d11792c2f9d116fdcd561583058611be53d905a8abebc92f7f5345710fa622136a6d536ea9a1e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346371, "uuid": "4998ce21-d38b-4536-a977-73df2933e2c2", "value": "T16103F827DF62F42ED04A92B15BDFA6219A23F8FA0332A0069395FF715F454C0EF95252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346371, "uuid": "23d8133f-25fc-4223-bd78-77c4b69da58c", "value": "768:ye8xN1xMRDWQ28X5lqDxBwM1aVMrghnIt+8VCvqiIkw20Jr09:xGN1xol4wLGMnN/vTw20Jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346371, "uuid": "cd8019cc-183f-41b6-ac9b-dfaa9b3ba902", "value": 39640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346371, "uuid": "057b220e-1d02-43a1-b53b-4dcd53cd5cc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346371, "uuid": "8ea4b78e-a80f-413d-8881-7417ad2a231d", "value": "main.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15e8f01-94be-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786368323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368323, "uuid": "bdcd1300-f286-4445-81b2-5ac403eaa1b9", "comment": "Malware payload (Vidar)", "value": "51e1a4ae6f00c790e8d29b8de352a3ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368323, "uuid": "c9cb9d3f-dc94-465c-bed1-d446f2250ed4", "comment": "Malware payload (Vidar)", "value": "800f0e436047e2facc03243f47bed1e946fe8b55d67049ec4bfc4c8d9323654b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368323, "uuid": "d64e73dc-752d-4681-b69c-90bd28a15cec", "comment": "Malware payload (Vidar)", "value": "8486cfc065d7b15f2b88162fd16d97c4ff04f0d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368323, "uuid": "eb50044c-e31e-4a55-a1fa-75bd60961732", "comment": "Malware payload (Vidar)", "value": "9e722eec23795759e80e959d4ee58324cfa9da1d50b7cc8c0bfb8e1c48359107917a32d967a7ef062e2cf238ff688257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368323, "uuid": "39195edd-0630-4e3e-88ab-55a46bbb10e1", "value": "T18C827246E25B52B4C8EBC337535B552715F8B8412236AB3B5BEC9A704D52370FB282EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368323, "uuid": "4467e90f-949e-4fd5-af3d-927f9bc4cee2", "value": "b94dba3155137e594dceb5b549504f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368323, "uuid": "9afcb0fb-6191-4484-82c3-38f4d3feb60b", "value": "384:1Am0nsxTmmkRe+zDri2+u/nt8VHAdTXPMyBOclG9ZliCO:BqRtbiNuEghXvs9iCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368323, "uuid": "2118fa29-ee6f-4b4c-b1ab-ab3337fcba96", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368323, "uuid": "ee843274-8621-4600-941a-1d8d7f228506", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368323, "uuid": "ca6e9f22-b96d-4fa2-9a38-bf1472021d0e", "value": "800f0e436047e2facc03243f47bed1e946fe8b55d67049ec4bfc4c8d9323654b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc88d5b-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371139, "uuid": "385fbb61-fd82-4761-902d-8f8572d7b6a2", "comment": "Malware payload (Vidar)", "value": "8ac65348b7dacab82a5063e01017222b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371139, "uuid": "780f8cfb-270b-4372-95ef-b3fb1b536dce", "comment": "Malware payload (Vidar)", "value": "8027988f209981c0e76552bf626212a961117c0f233ee71fec490304b69270a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371139, "uuid": "18ae69d6-b232-4d6b-a66c-d19c07bab152", "comment": "Malware payload (Vidar)", "value": "a6799af46b0454d5f9e709647e77c21135297d2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371139, "uuid": "981bafd0-ab5c-4369-a143-289854f07981", "comment": "Malware payload (Vidar)", "value": "3bd67a5a2906309e24b68b60ca4685c4e1da84fa1b634b137b9c78bedcd63d55c0ab792d82a214798737c97a0ce9a253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371139, "uuid": "2e349753-07aa-4c88-bef5-7634a01d3247", "value": "T1B05219C731D271FDD2B9833CCA4666BAC7733082032B1FFFA9ED89943A9251525AD611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371139, "uuid": "87258080-bb1d-49fc-9316-06c6fc586c7e", "value": "1d01a4090e36ef1b5c2376910836a381", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371139, "uuid": "fd6566cb-25de-40a8-baf5-3c05b27f6637", "value": "384:OCh4X9Ena1+Se0Yn1xsUEpMcibmbSLJKll4:0s0csTpJamWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371139, "uuid": "8d439e02-1b3b-4b69-ae6d-d100f307ae2b", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371139, "uuid": "0fd5a1b6-b1e5-49d5-ad9a-cb7f9a264c84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371139, "uuid": "62efd18c-4d81-489b-8eed-a26faef2f1f0", "value": "8027988f209981c0e76552bf626212a961117c0f233ee71fec490304b69270a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd93d3bd-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372129, "uuid": "69610a96-7ddb-4e03-8fd0-71e230f21745", "comment": "Malware payload (Formbook)", "value": "c8c1f264c90e992f8b729a82c15c3aa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372129, "uuid": "1ec96299-2afd-42e6-9a3a-f3f6e6bee571", "comment": "Malware payload (Formbook)", "value": "808e5128540188f0345be602798bb90c6764cdf74ffa052e6a8c7d6c0f988e7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372129, "uuid": "35e61c91-b335-4abc-a136-e02b48ff59f3", "comment": "Malware payload (Formbook)", "value": "b5766265b80cccb7a65c7be0c10c03421bbcb180", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372129, "uuid": "d7db9cec-767e-4d00-9470-5e28dc3d9111", "comment": "Malware payload (Formbook)", "value": "e867b1325d3d6ae27d5bc48f650693ee3b9b0a9486beb0977c6525327b01db97059a05391197c7ec30824a5a7baa04ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372129, "uuid": "b7ee8528-796e-4346-be6a-d1a741f5a115", "value": "T19A2512694729DF06C5964BB049F1E0F243B56F98E426D3039EEAFDEB38363661818343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372129, "uuid": "570a9bb4-4610-459d-9338-5cdfd2c0aaee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372129, "uuid": "331b7501-ee18-489d-97ff-a94ba0737272", "value": "24576:Pj/Og3BL4bFSGIWXODrNTyzD3BnZdzQRh6G4xUK5huORW:bPxUbgyXMgBARh6GPK5AO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372129, "uuid": "378c5e67-d7c1-4c11-acb7-cb4e433abf92", "value": 1030656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372129, "uuid": "c9c84f22-6560-40f7-b7c7-809f70a8e94a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372129, "uuid": "510c600a-2e45-4caa-8110-6a2fe8584071", "value": "808e5128540188f0345be602798bb90c6764cdf74ffa052e6a8c7d6c0f988e7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df047bd-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786374062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374062, "uuid": "c67820f5-99cb-49c7-9bf3-a69c70da9fab", "comment": "Malware payload (VIPKeylogger)", "value": "71fcffd0c84c491f38b62710fb721dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374062, "uuid": "a9c70946-0889-4ce8-8743-a7968e647d57", "comment": "Malware payload (VIPKeylogger)", "value": "81617153df10cae3b6d457872a32b4a99c1422c371f225a2bcdaf1f08a1ef563", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374062, "uuid": "c51d09b3-f7e2-49a1-a25e-c33bc073b525", "comment": "Malware payload (VIPKeylogger)", "value": "d0617972b76508a76ac094d69d37213bf722be6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374062, "uuid": "99514841-ff3c-404d-9d85-89a440968502", "comment": "Malware payload (VIPKeylogger)", "value": "ec9d468d9c18f0d44a5e6e5f2a5902fc46451e9edf45372ff780fde7a6498cbe3e2991c44cafa7f9eb422f381fd6a320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374062, "uuid": "ab6251d5-2662-40ae-8f58-b18a9b63f6f2", "value": "T16735F19C3601F48FC9478A358EA4EDB466146DBA9307D3039ADB1DEFB90D997CE041E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374062, "uuid": "7d7f69dd-57f8-4835-82ee-453de06b0f55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374062, "uuid": "daa212a3-7c5e-4d4f-9417-03fe5d47d12c", "value": "24576:24eA9sLJzbLcEXSTGj72aWGXI5L7Kw0H3w:2hUsLJzEE7j72aWGqnWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374062, "uuid": "3e8d579f-dacf-401b-afee-9e1753a4e9bd", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374062, "uuid": "a043581e-ec2c-479c-8064-5d3d5209fcd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374062, "uuid": "63071f18-5c6a-4e73-8e3f-b5df147a27f6", "value": "81617153df10cae3b6d457872a32b4a99c1422c371f225a2bcdaf1f08a1ef563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5388648-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372517, "uuid": "4dc79145-0b58-452e-b404-da51c8c79501", "comment": "Malware payload", "value": "25b88362ca18c877ffb38e3d711ae479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372517, "uuid": "edce1b06-0407-48db-a4c0-1f2e2a0b6d56", "comment": "Malware payload", "value": "81850fd796e155b48ca148b0938af3a2bd36181ee7043ff11b9e6b186ae2dfe2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372517, "uuid": "5a54a9f3-68e0-4249-a816-7c08b3812aae", "comment": "Malware payload", "value": "dca3709b9f13ae94e072700b72af4c0c43b35238", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372517, "uuid": "665f6458-5364-4379-93fe-63e213e537db", "comment": "Malware payload", "value": "2c3e111b7042496fca19f5523b5799cefaca295b108b37a8e7141b31c705bd6617b60307e3a0676a5dd3f3ce9c260229", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372517, "uuid": "bb5715ba-c132-4c18-98b9-45f0ab69678d", "value": "T15904020977C0C07AC69396300EB6CBFAE673E76406291B3B2744AF6D7E702C1DA09795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372517, "uuid": "394caabb-6356-4340-b381-2cb526d193d4", "value": "e221f4f7d36469d53810a4b5f9fc8966", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372517, "uuid": "d34c96b5-60d1-479a-a5db-0535d6f6f3e7", "value": "3072:1LfVxlyEZfp9zIb45zUT+T9B6nGhtGh0zXBlKZiu8ow6zudPM+ku1:ltXZXcMjKGDLXy8uUwu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372517, "uuid": "7c716862-74f2-4f6d-b146-c2c234aa7b9f", "value": 176623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372517, "uuid": "89d21846-6791-48d1-b87f-444d3456b4b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372517, "uuid": "eee0b34b-ac24-4a66-872d-9efa4e2588cb", "value": "81850fd796e155b48ca148b0938af3a2bd36181ee7043ff11b9e6b186ae2dfe2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd98ae5b-94fc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786394865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394865, "uuid": "ed2257c8-3b5c-4d5f-8c2b-67e270922c67", "comment": "Malware payload", "value": "59e7dcd3bb188208dedee13b705c5b1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394865, "uuid": "93f59947-b816-44a7-be53-831342dbcf36", "comment": "Malware payload", "value": "81c48742cfb6e74f027c5b4a3a4cedaf6ce524d29ea61ee8aa021d04fd0f5024", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394865, "uuid": "9e548211-9734-4c62-9a68-24004d98f550", "comment": "Malware payload", "value": "6c704dc9863f8862f70b64f5cfa59a7ea3e78548", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786394865, "uuid": "944e333e-459c-413c-8b1d-4eb94d86d4e6", "comment": "Malware payload", "value": "a886adadae726a1573c90f654cf38c4384b0484bdb4b9ff53cffec4d2be531a95192cfdda5e635c318b026fa8e2ee7bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394865, "uuid": "fe2391f6-e49d-49f6-a209-e1c16c62370f", "value": "T19FD31A05EE047ABBD09E8E7845BFC19204D53DF7A2D4833976D86A8D7A3C65906C3B88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394865, "uuid": "53b3889a-0f7c-4fb8-9090-62650d87d9b5", "value": "1536:L1C1vQgQe41Za1UO3b1c7wfJLXI5PMErecDHh:wigf41gy7uc99DH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786394865, "uuid": "a356a1f4-30a6-4705-863b-362194564554", "value": 140260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786394865, "uuid": "16ae917a-a10e-4e6e-ad3d-cf5feb7c79f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786394865, "uuid": "d041d6d8-015d-4e10-b112-d8a48228f1b9", "value": "main.mips64r6el-n32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4bfac2-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Genasom)", "timestamp": 1786373549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373549, "uuid": "ed84da85-7ee5-4d93-a959-ed78e18e4083", "comment": "Malware payload (Genasom)", "value": "fa0913bfe83efe092998da70975b5918", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Genasom", "colour": "#E152D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373549, "uuid": "b4d07b7a-a178-4fc7-b17a-07791c11d636", "comment": "Malware payload (Genasom)", "value": "81ca5fc6b55accdbc44266d66bd72c7c4152a75b215593adc433d51250054333", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Genasom", "colour": "#E152D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373549, "uuid": "27c86f91-31c7-4809-bcc9-cc07dc477ce1", "comment": "Malware payload (Genasom)", "value": "bd33c151352ac50abde82d9e5fdff845f5c77710", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Genasom", "colour": "#E152D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373549, "uuid": "8daaf876-4545-416a-9a8e-0acb9a82df93", "comment": "Malware payload (Genasom)", "value": "63e7ef3a16d98279fa9d066872c3abfd2d19a8084a6c7427caa9d97d9e34b43c40aa616ddb28ded2c443798f6f14c62a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Genasom", "colour": "#E152D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373549, "uuid": "e37f6fc5-eaf5-462d-998e-0573bb172460", "value": "T1DFF37C5771E276FCC116C034420B8962A9B2B81D07216DFF229ABB342F99DD16F3DB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373549, "uuid": "f23d8b05-1689-4be9-8c14-a90d52f64a41", "value": "2a18ed1f0638874d776afcc7d7079aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373549, "uuid": "763f9fd9-8e6b-4c1f-a682-af5c9aae317f", "value": "3072:1309S0CIpUOJQAjXJaDMVJxAQWroYGzQoD:UTX6ENVJxAQWMYGMoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373549, "uuid": "b4941951-9940-42ed-9701-df0ea7b30e61", "value": 157696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373549, "uuid": "5871c32c-504a-48f2-a99c-77d93c62c1e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373549, "uuid": "a28d9b3b-1542-47af-8b26-fab7b0b31a1a", "value": "81ca5fc6b55accdbc44266d66bd72c7c4152a75b215593adc433d51250054333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e12b2c-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372493, "uuid": "a85899cb-f446-4227-b1d9-5975e8306e3d", "comment": "Malware payload", "value": "10fe54ac8037949805cacc1534ef665b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372493, "uuid": "36c8ffcd-7a74-4884-b4b3-e836afa475cd", "comment": "Malware payload", "value": "82b06ec2d0a6835c9436e03fefc7c0569261fa7241b067a8ca4decbe5b951146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372493, "uuid": "4054d037-3640-430a-953c-1252cb28551b", "comment": "Malware payload", "value": "8dfe74126904adb21bcacccdf7f1bde6d2db0e26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372493, "uuid": "7923b054-3009-4d21-b37a-973979327ac0", "comment": "Malware payload", "value": "b3d63b9c3762f620efe75db1880640a43c96f447abe919f4886f3f7b790dd4ec1e4d832943d0ad93e2b13c2553cb9a47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372493, "uuid": "7bd379a5-fb05-4a0d-bb32-17678a899a1e", "value": "T14345F11913E4AA68E4FEA73197B4001147F2F80B9636DB1E6D4C50EE5F32B819967B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372493, "uuid": "9b0d808c-ae27-4584-a173-6bd2395c4f2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372493, "uuid": "2ec6d18b-594c-4690-8b18-06b917f55353", "value": "12288:Qhbj/T4OFyLHK9Jwe4ezKWusA8Z2vjtxIcYzLzuZeGRpQ6s7Ew7z4RH6qQx:IEOF8HKLZ4e2sAh8cYHJiKhzyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372493, "uuid": "bfbaa139-14ee-4941-9e64-ab4d54dba910", "value": 1172992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372493, "uuid": "4f00b303-0fdc-49d7-a753-8fab5190969d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372493, "uuid": "87abc52f-22b6-4823-84cb-975baa18342d", "value": "82b06ec2d0a6835c9436e03fefc7c0569261fa7241b067a8ca4decbe5b951146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475866d3-94fe-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786395526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395526, "uuid": "8d25595d-f05e-4060-a732-80bc2fe4109d", "comment": "Malware payload", "value": "f7107fe8a1d922ffcd00dac36ecac3f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395526, "uuid": "759d524c-b460-4383-bdb4-1e50200c616f", "comment": "Malware payload", "value": "830a22ea4eb2ebb8c60c7731fa5175d3a315d023a812aea40147326cc4c8a4dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395526, "uuid": "34269923-28b5-4b4e-a93c-2ea8f6ad560d", "comment": "Malware payload", "value": "e86878e09b9c24c66b65bf8068ce8586be9b8dc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786395526, "uuid": "d172ad61-8064-4eb5-8014-4d582403c713", "comment": "Malware payload", "value": "890a2a23b399e035b46f3b224e896ab3d4d630ec76fdc92e61eec58ea9c3e44e4f5903e9e33f5c9082793c97fe542679", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395526, "uuid": "2ea2361b-f05d-45fd-90f1-1c37d496353c", "value": "T118B6233BF15B653EE06D1A3A3A76E150993BBA6165124C1297FCF88CCF250700E3E697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395526, "uuid": "f1a8d7fe-8dab-4ba0-ac26-46382d9e1f6f", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395526, "uuid": "efefa094-103c-4859-b6b1-c00825aa0802", "value": "196608:cyigH4kiY48zSXR2iAMT9nfE8G9R4YaHF39msUI5Otn68zjaIBSbA:cyUkiY4Kmw1YWN4LasUIq6QjaIAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786395526, "uuid": "9c7f4678-f5ce-4bae-987a-d443e5e692df", "value": 11408385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786395526, "uuid": "cdf0b682-44b3-418d-be65-12b979ea5371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786395526, "uuid": "410cb514-2ec5-42d1-b3b8-a9b3d8af6e47", "value": "830a22ea4eb2ebb8c60c7731fa5175d3a315d023a812aea40147326cc4c8a4dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edcdf68-9493-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786349502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349502, "uuid": "ff51d496-54c4-409a-8896-6c18222a18dc", "comment": "Malware payload", "value": "b691a8625a13895d84a03e5327e21379", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349502, "uuid": "417087b0-a0df-4f6a-bcef-3ffd617af0ec", "comment": "Malware payload", "value": "831bff80c68a452ed86560f568cb655740ba0f4c9fcb5f34e86bdc7585a34cf1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349502, "uuid": "5a1d1d85-5c92-41eb-a213-d3934ebde7e2", "comment": "Malware payload", "value": "ce23552fdc17cd9610a4819913f57e21d0270711", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349502, "uuid": "91ea1d51-0775-4349-b042-68e01e6d1878", "comment": "Malware payload", "value": "8d0e2be141e08e5f35915b417e167e0380293d1e22cffd46628ca5b4aac21e488e2e614f441371545be298bfadb9cd31", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349502, "uuid": "ac5eadb4-1eff-4fc6-993f-92dbf10da74e", "value": "T12F313E9A00105A715002DE9E76A73658B54EE1EB9D8FC7D4D9484EAE8288BCCF221B8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349502, "uuid": "68886249-be11-407e-bdb2-70e9d3ce9c44", "value": "12:UNt66NtojD0660wbHJpZUsDMd6M0JqH8nqliB6iHrGQfs6AFL6Frb5jQr6jrA4xL:MxokHtUsIxFHx8DHrGibDjon3JHw5s+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786349502, "uuid": "93bba402-6061-49f8-b601-de8b01432668", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786349502, "uuid": "6d2fe380-3dd2-48de-a085-5b85aadd19da", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349502, "uuid": "578f0a9b-e4cf-4c9c-874c-0789a70888fb", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec419f4-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786370493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370493, "uuid": "c2d47ed1-b7df-43b9-b762-a818edd357e6", "comment": "Malware payload (Vidar)", "value": "8aadead6badfe60c5ca2cf5d962d3a3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370493, "uuid": "137b00be-e827-417d-bc91-c1bd84b22a19", "comment": "Malware payload (Vidar)", "value": "8329137dd7ff157263be8ab4a9cce4b08d413724d781b9568759e969e33644e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370493, "uuid": "6868bd51-b9af-47e9-969e-f908c846d778", "comment": "Malware payload (Vidar)", "value": "986ecea6c0ab4791094d28b6c0108a36e00d1b4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370493, "uuid": "7457801f-b98c-404b-85ba-24368a4130e0", "comment": "Malware payload (Vidar)", "value": "552eba6a6f3c39c96a7269651d2cddf0765223807631aa9b97d10884ae94352ecae16e2a2f3f8cd9b7926fc4a1863388", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370493, "uuid": "4ec0c5f6-fa8e-4980-9790-d9286869522c", "value": "T11D52F886B1D760BED1BD83B8CB8B17BADA21309506095EFF26DE81843A8361175BC724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370493, "uuid": "3246cc8e-b6d6-4b45-8035-e86b4d27335d", "value": "850ee0121fda1022e1c1de250e3e1e58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370493, "uuid": "2789d9d8-8705-4a97-8922-219bad5c2b65", "value": "384:OOgQyN/Xu/yV6s9MgBb93eF71Iua0lOG:fyNvu1GzbwF71IuaaOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370493, "uuid": "e497aad9-8cf5-4e4b-98dc-0b57462dfb7f", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370493, "uuid": "00229cb7-dab6-49fd-8034-4e38558e080b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370493, "uuid": "3ff10fa6-1926-4754-81b5-0ef4adcd9ad3", "value": "8329137dd7ff157263be8ab4a9cce4b08d413724d781b9568759e969e33644e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe8d55b-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786372992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372992, "uuid": "f85c3624-f313-4663-8e3e-77ef8e1f4828", "comment": "Malware payload (MassLogger)", "value": "63f81bf65492c26df9f41819cc39ce2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372992, "uuid": "fb3551ae-4d42-4491-af42-a3290fc96d01", "comment": "Malware payload (MassLogger)", "value": "833461a1d6926823da8ed605a49a01b762fd30fd9036715f8020b83a937ca99e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372992, "uuid": "620e1c52-5ab8-4484-be65-60215af398be", "comment": "Malware payload (MassLogger)", "value": "295cba9d4650b753541a0132d65e57d0a791c025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372992, "uuid": "2f534d1b-2b29-479e-afd4-3155690cc4bd", "comment": "Malware payload (MassLogger)", "value": "b74f5c1736ae39d5e5a5514fffe429f3f6166d3247cfb0ca3257b1b40e8387a53c65829e3740dd38bb09a346da1cd258", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372992, "uuid": "85208403-054a-4fad-af7f-9b3304a05cd1", "value": "T1F235F1042267C802D0E68BB6B9B0D37433741ECE79E7C2D69FD96FA774193C29994782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372992, "uuid": "4d43a9fa-9da5-493b-a62a-dee1a648961f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372992, "uuid": "419d7a67-34cf-412e-a3c8-08f1f5d37d64", "value": "24576:fp50c8yqrcxqpt+o2kWGKUZ7qb7yGLEENKZQ:fp/ZxKDKmI7yGAEYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372992, "uuid": "539ecac7-9570-480c-9ea9-a4a02400fcb2", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372992, "uuid": "7060a1ce-6d68-438c-811d-9431444fdc4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372992, "uuid": "a847a64c-d96b-4f8c-a5e7-023b87871f5d", "value": "833461a1d6926823da8ed605a49a01b762fd30fd9036715f8020b83a937ca99e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a291b8-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786373243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373243, "uuid": "65a22f2e-21ff-4e10-afa4-cf2ca1f0d5a8", "comment": "Malware payload (PhantomStealer)", "value": "98d0e9c11402f9510835dc44ebe85ce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373243, "uuid": "0888e696-74d0-436c-9359-8602e78b8532", "comment": "Malware payload (PhantomStealer)", "value": "83b642af65de75e7c93a679a8aec05c860f4e505b841fb3e148272a33f58a9ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373243, "uuid": "8b21d79f-806a-4e6a-92a8-7da9237e670f", "comment": "Malware payload (PhantomStealer)", "value": "b3fc85b9041c47e74a4b8f1ac11e84e349d2f3e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373243, "uuid": "1ebbfe46-f393-4b1d-8472-ec9564b399cc", "comment": "Malware payload (PhantomStealer)", "value": "c95cee1ece4649f152e828b860488aeb85d7767b584247584344f03e96f3243ccccdc38f0777768c2e08b6aa856d3fcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373243, "uuid": "22074589-bd0a-4f46-9ba2-8c4e211d9962", "value": "T17655F00B5E16FA41D0D587B7B9A0D33C22A91DCE7CE2D2834FEDBEA3F5392811954642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373243, "uuid": "94ac63d7-ee10-4839-a325-5a414df64f48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373243, "uuid": "bad94180-d211-441e-aa80-b576359d5b0f", "value": "24576:+2HElN3dMI6yU1v6QpwMP/5nBKn2bgp50:+vN3dMNyUpl/5BKn2kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373243, "uuid": "b0176fa3-7686-49a4-89e4-787f7d96fbd5", "value": 1300992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373243, "uuid": "44c12dab-323d-4706-a6ad-0f087ca99c54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373243, "uuid": "c9d2b874-3bbe-402a-9143-06e1ce40ef17", "value": "83b642af65de75e7c93a679a8aec05c860f4e505b841fb3e148272a33f58a9ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4153c66-94f4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786391494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391494, "uuid": "b86b8126-c051-4252-90c0-c7bef8b90ba3", "comment": "Malware payload (Mirai)", "value": "fff0a9204f08a82a740b73802d03ab36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391494, "uuid": "d20974fc-3bce-4e3c-976d-e208f8fc1324", "comment": "Malware payload (Mirai)", "value": "8427c454beac56118f9fcf25eee1307f128af847e2943fa4c5add10952a4127d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391494, "uuid": "5a7e6ccf-b585-43c8-9312-34505d42c65a", "comment": "Malware payload (Mirai)", "value": "ac1fd954a36bd66072c396cbfba3272f07951cc8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786391494, "uuid": "cfde2302-a21e-4cf8-8c3a-31c224af74d7", "comment": "Malware payload (Mirai)", "value": "938ca2245aca280aca5185508824535d10a526f28dd80622cc84c1b26f85ce34c69103d5565f10bd7eb1f43a4f7c0053", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391494, "uuid": "c9e3b7e5-24e9-427f-a51c-ad70d87251a1", "value": "T17DE34B02B30D0947D2632EF03B3B27E1D3EFDA9120E4E684651FAE899275D31558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391494, "uuid": "3b5dff1b-e28f-46be-b3e6-eb0e9b6c7fd9", "value": "1536:/AEF1/87shXSxDME52wRb0i5xCZa4FFuMSRwhSg4PHuGaBN8yOQqlvAL+KGgqPYk:4E3moXSxJVQZMP+BeALTM+kvHyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786391494, "uuid": "56e4e01d-a17f-4e87-bef8-ecbb214fd2d9", "value": 150204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786391494, "uuid": "0fe93cfb-7f58-48b9-bce4-5d0ea7f09994", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786391494, "uuid": "cd360bdd-0fd7-4211-a25f-c9eb556b8c93", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38db338b-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786355558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355558, "uuid": "fad0812c-0cbe-4f00-925a-d9086e4451b1", "comment": "Malware payload (RemusStealer)", "value": "2e4aa86a1df193c715970aee3096bf3a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355558, "uuid": "caefcdcc-9f32-4bda-a98f-5388a713250c", "comment": "Malware payload (RemusStealer)", "value": "843b927de18b16ef40abb48067b6be80e4c63a9e9600342ca672bc75e84e7a48", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355558, "uuid": "c5b80561-5e6b-495f-8747-c2f85ef9516b", "comment": "Malware payload (RemusStealer)", "value": "4c34f12dbee3457a9c1cf5185f59fc56084de8b8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355558, "uuid": "61abda40-33c6-43c0-b04c-38e1e66c017c", "comment": "Malware payload (RemusStealer)", "value": "1547294b4d8b04c2d4ecdf9336d540c4daa15950b34f2a92cea9c12715c0a9eeca50c68294ea553cfebcb9b2af7a199d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355558, "uuid": "4cfce741-947b-4c37-8a39-c449fc2d7781", "value": "T184D63A13AE5649F5C599E735C8B74616BA70B809473133E32EA2BE782F723C16E34B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355558, "uuid": "89586742-6db7-47ec-afee-882603583d1d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355558, "uuid": "f28d952b-4e3a-4d1d-ab9c-5ddf7c1ad2a9", "value": "49152:eO6pqtumqgwR9OHynqB1px6BnMp16WD5qACtXFdO75A8W:evqqi0WAO5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355558, "uuid": "a0537441-0b10-4bfc-8b6a-c44bae2ca9af", "value": 13869936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355558, "uuid": "4ea7d86b-39f3-4918-86d6-fe26925c9e4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355558, "uuid": "4386566e-246f-4718-a858-ddea004786b3", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ced4a9-9462-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786328737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328737, "uuid": "a096e03d-a40c-45c9-827c-5416b3c68ad7", "comment": "Malware payload (Formbook)", "value": "f77fd04907846cd52c41ed987ca960af", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328737, "uuid": "4f2ece52-19ca-48b9-996b-6854eecc20ae", "comment": "Malware payload (Formbook)", "value": "844aba4ec75e4f229d096f01a2582c66c9bbea1416077cf479fa07d237dc1103", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328737, "uuid": "92c10180-0986-463a-ac55-258f9e4dfe74", "comment": "Malware payload (Formbook)", "value": "23a1e7f3913f83495744bf7d5aee793800e01164", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328737, "uuid": "04f07670-8e9d-41d6-91b5-1c1bace400e5", "comment": "Malware payload (Formbook)", "value": "a72ccaf222fade12671730a02d68ad1d9743b2f40cb5e4df6d239154e54b3c1dc7b5fa872d10b4426d9d7a296241cb9b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328737, "uuid": "b902a6fc-99db-47be-8f81-6f2f62fbab4c", "value": "T194E5C7B232DF658A991C3705A44C14A90F6F845A2BC229EDF4CF51951F1F84A7A80EFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328737, "uuid": "223eb1af-1401-44c1-a823-08a75388e941", "value": "12288:tZxRDNkbgIgVycoThv/TQS4c7glxSsOJRYkWK4Iq7mczvvl3Hjse5AVoB52bDhxP:RlNXShkZc7JnYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328737, "uuid": "9696f912-5c06-4c96-be1f-3ffc33a3e111", "value": 3130202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328737, "uuid": "f8d1fd6a-06e5-4e07-94f3-534c7c888830", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328737, "uuid": "bb0e092d-70e7-449b-ab9f-2ae8ec56d956", "value": "ORDER_202606001pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d5ae81-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369111, "uuid": "cf54737c-4bca-4ae3-9be7-ae95feb454d3", "comment": "Malware payload", "value": "b1be8f73aa63acb37e7b215d76230f3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369111, "uuid": "5b1f1926-809a-46ec-8f1b-cc16d64198d5", "comment": "Malware payload", "value": "847cdb3d213124abda19f137c228262f32c4f06e623c253e407f17375bf54d05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369111, "uuid": "f209ebb9-f92d-4838-ba2f-3a11501e0f7d", "comment": "Malware payload", "value": "44e7daefe14399849961880a83fb3ae109da3426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369111, "uuid": "cca53d86-211e-4419-8a66-a1c3d18b5b8d", "comment": "Malware payload", "value": "e21b2b2807d57d32086c60954f6f4ed6e5bd276515513547ff6a8a53817034abcb5c8dfb2a511618643a9b777463b73a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369111, "uuid": "28be9757-7491-4dd6-ae5a-1bdb8d07742a", "value": "T12815013D5E8BAF52D57C0FBC817604A837F0C11B8126EB2B3FED41F49A527D95826292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369111, "uuid": "15a7e984-5943-4217-b1b6-43d4346693d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369111, "uuid": "ce4427ef-b4bc-4398-9c75-1112bfed0dba", "value": "12288:JCn0gh4E1339JCzll10/MLR/3a5py7Nl4NHo2agxIEw2GClNsf:QP13NJC5HPxaXyH6HzLmEw2GClG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369111, "uuid": "1f3e45d0-1cf9-43ad-895e-5374400da1c1", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369111, "uuid": "b85cca55-8358-46fb-8263-1687e8440779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369111, "uuid": "fb7750c0-0347-4f71-a4d4-f9ca339ef6a8", "value": "847cdb3d213124abda19f137c228262f32c4f06e623c253e407f17375bf54d05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02918e4c-948b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786346018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346018, "uuid": "76444a5a-1228-4652-beef-bcbfdfeb5024", "comment": "Malware payload (Formbook)", "value": "2bb5d06f6b0327153abc2b623381a444", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346018, "uuid": "6a746203-0dd6-4beb-917f-81bab4cef4ce", "comment": "Malware payload (Formbook)", "value": "8484e5f8dc68f1f0cf77fe95bc564b67ddaec743c1fb1d76a167618da248649c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346018, "uuid": "d9c44db1-d53f-423f-86b9-eefff173a905", "comment": "Malware payload (Formbook)", "value": "dec14fe3607582191986d959405837e27384e226", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346018, "uuid": "dd0a1795-1b0d-458f-87d6-88fe6572bdcd", "comment": "Malware payload (Formbook)", "value": "2f3fd0f375f4875e3286b3234ec39e1768767e670b8464f51b1377180fe7a12e5e3c68c4b817bf795ab1370a0fa2a630", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346018, "uuid": "70c0e7df-8c49-4ca7-97ee-70df74537a14", "value": "T101E5079227848172B720BBAE6636DE359A1FA01315D2DF01316DEB24361CD5FA34CEE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346018, "uuid": "4b7b141e-f358-4ee0-b03f-47ac0edce743", "value": "49152:ZNFntxAao1gnMKHhLkh89VVAnyzFLU0ZbiN4pDdfLgWf9qCxKRcUmXnlsvbNAXWs:ZHntZsSkh89Vcy5LUobiN0dfLVf9qCx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346018, "uuid": "610ecc70-c053-46c8-a656-ae07594d77c4", "value": 3092554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346018, "uuid": "cec5e1f9-af27-44ad-a621-d9f4bf7fcb16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346018, "uuid": "e678c5dd-9760-4ccd-9b50-4c039fa8a446", "value": "HSBC_PAYMENT_CONFIRMATION_RECEIPTpdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69c3733-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368762, "uuid": "f498bae4-ac2f-4875-b95a-1e471c382ef6", "comment": "Malware payload (Formbook)", "value": "eaed111763b07434094a7081b6b9dadd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368762, "uuid": "b58c51db-2de3-4dc6-8631-6a2d6dc9312a", "comment": "Malware payload (Formbook)", "value": "849db861fac58ffab1622acf5312eaf9c07b87b8ef7a5f0c333e3e8cc07ea9b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368762, "uuid": "09faf4c4-5a22-4e61-9cf7-90b11f9474c9", "comment": "Malware payload (Formbook)", "value": "14d056ccbbf8be9e7b722abd10d97b1ac805b3da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368762, "uuid": "faf253c5-9ab8-4301-9ef9-e0b668dac7e3", "comment": "Malware payload (Formbook)", "value": "a4a4de4bcff9f9916d85c162fc892ba624365ea7cd4f063d918d197618482a1779d5690eff93f0794478d0c3f84f1e1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368762, "uuid": "99e1c015-12b3-41c4-908e-62e727197b3c", "value": "T12335F1C03729A709CE79AA308535EEB457A92D28B010F9E66EDE7BC775AD3015D0CF42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368762, "uuid": "0d4a3c6f-ce9b-40f4-b3d9-9b9c3b926c78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368762, "uuid": "17fd724f-d421-41bc-b1a0-335b1803f6a8", "value": "24576:cqGpSOFX0olqdkZJQtFQGXXJA8PuqS7D:ch5tXnQ/QuXJDPVS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368762, "uuid": "e98dc1ea-37cb-4179-807b-e258eddc5bd3", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368762, "uuid": "65fbf1a4-e9ea-4633-9032-92a3f3c460a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368762, "uuid": "3d027a9d-f75d-4468-864f-f6d5740961b4", "value": "849db861fac58ffab1622acf5312eaf9c07b87b8ef7a5f0c333e3e8cc07ea9b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb3bacd-948f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348076, "uuid": "21755555-3f25-4130-9577-e556d0685fca", "comment": "Malware payload", "value": "091bb8deafbb346042aa45ed26c488e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348076, "uuid": "8ef70565-ee70-4dd8-a43e-37857ecee0f1", "comment": "Malware payload", "value": "84acca783aa0926816703ce272543607e332f89bebb2867b9cc8f7218fc5ebf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348076, "uuid": "0612eb58-a541-423d-bdc8-5869bd4dd294", "comment": "Malware payload", "value": "8bc9ae02c0876312ea002cca556afce01f75df80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348076, "uuid": "e7afc7a4-e3db-493a-a165-f14af6102569", "comment": "Malware payload", "value": "02fea442b0f0d8bc54869352b23e312a3bd102efa1e55424da24cc3c6eb7acafc26699b25ff1ed465ce76305469bb2dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348076, "uuid": "d5e74c6d-43e9-4d31-be17-7109cca9acc4", "value": "T11303F981F247E632C817553567BAC75A3B4379D73EA2C200A825EACCFB674C06DB0927", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348076, "uuid": "2d84fef7-ac98-41c2-be66-debfc6cdb7b4", "value": "768:O1sMX5As+KxEDOok3IkWaduaeye8n9UgTTyDPFNzRLIAbdPu4XT3di5tm2b:O16HSfe86NLI4FXrh2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348076, "uuid": "33f0a1c7-6a35-4015-b957-53edb8ecfac5", "value": 40640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348076, "uuid": "4bb279c8-c1f9-485d-ba48-a7e79340bc48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348076, "uuid": "011b49a3-8032-4f2b-88a8-cc2d0604646f", "value": "main.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e34903-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372384, "uuid": "4ab84a5f-bcbb-455b-9af3-5f9b144d79fc", "comment": "Malware payload", "value": "ac2ce3ef34dacf00f3e1635ee4286dff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372384, "uuid": "96eb4554-08d8-4a73-945d-7a2d223c94de", "comment": "Malware payload", "value": "850f2bd1d7cfc653944dab58e6f656fb7e6d9781d10a85ce8113fc57552363f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372384, "uuid": "38ae30ec-49fb-4e9b-a618-4e23bfecd9de", "comment": "Malware payload", "value": "a0f13740c73f29ffc536910108487d05226c88e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372384, "uuid": "acfa371a-032d-4314-ae2f-72e6b02e2e6e", "comment": "Malware payload", "value": "f18573870ab9671cebc3f61879d2fe609cf9fcf9a53c6b1e3ece2f2d14efa4e47bf3d3a685ac89e17024d5dcf21e7b4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372384, "uuid": "46fd2201-35e7-401c-bb4c-dabfa19828e2", "value": "T18B35F1255D833A44C53D1FB8D167159873F0D407A2AAE79A2FF840F59FA3B86CC2B492", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372384, "uuid": "3f5040fb-adf3-430b-9ee0-a23e306cbad4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372384, "uuid": "72c7968d-e1d6-4c35-a667-614341752106", "value": "24576:ckUOF8HKLZ4e2sAh8cYH+6HzLkEw2GClGJ:f2HKtH2t2cYBHzwEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372384, "uuid": "2eb88b7c-7fa4-4675-a0b6-97a364a89a3f", "value": 1125888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372384, "uuid": "0681609e-9f4f-4c6d-8259-56fe3534b2a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372384, "uuid": "54f03757-7fed-4e78-b0df-89242a7c66d3", "value": "850f2bd1d7cfc653944dab58e6f656fb7e6d9781d10a85ce8113fc57552363f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01543b70-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340003, "uuid": "bd124802-de8d-486f-b1ff-9a8785fcfa95", "comment": "Malware payload (Mirai)", "value": "f591d5fc7ed6e34eb90916e74590669e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340003, "uuid": "1dd9b01e-4f77-48ca-83bc-d9e3abedfbab", "comment": "Malware payload (Mirai)", "value": "8522dd99e4ea41eb22ebd4e2867d0a993e5c93ae2b3e55aad799808d9e01ca34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340003, "uuid": "a7d29d57-171d-4967-a910-d98008c6a4a4", "comment": "Malware payload (Mirai)", "value": "6450af91eef9cf2acf16e83016dbff458e4e6878", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340003, "uuid": "923e958b-5cb6-4064-9ea4-edeb3e124a90", "comment": "Malware payload (Mirai)", "value": "4892fc48d6bef63f44f139c93be4efcae189db7fa3e0af7cca7d04e993d9eb99919f9fdcf6710e9a09c976b0d9b1ec4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340003, "uuid": "978c847c-7647-409b-a38a-e24d19b73f2b", "value": "T122E41B1AAF500EFBD82FCD3705A90B1635CC699732A63B353534DE14BA5E90A89D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340003, "uuid": "1d35b022-22eb-4fc4-b24c-3516c5fde396", "value": "6144:96MZdIj1HuByPVuvT0S3vTJMCvMFUyDF5Ps2ZljrG987aFN85ywWnr:96UsmT04TeCvMFlP73X7M85yrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340003, "uuid": "c7e88907-b189-41ab-a058-49623b0b1cf2", "value": 681348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340003, "uuid": "1427a5c2-b50a-4370-8544-3f615bd04f5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340003, "uuid": "ceadcdc1-6a12-4a35-8d3f-c706e6631618", "value": "8522dd99e4ea41eb22ebd4e2867d0a993e5c93ae2b3e55aad799808d9e01ca34.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f38dfad-94b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786364293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786364293, "uuid": "73e8f954-e4dd-482f-a06f-804f637c530f", "comment": "Malware payload (AgentTesla)", "value": "c04a92d4145681e8e4ad3111e055e208", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786364293, "uuid": "da8926aa-b477-4ac6-8faa-6b8be43b15d0", "comment": "Malware payload (AgentTesla)", "value": "85269163ce84b80ed9408c3538054b42e6aa035b7c7b1c496cdabb9acf87a7f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786364293, "uuid": "e3b93772-c9db-4eac-8ef0-7e22d5211b82", "comment": "Malware payload (AgentTesla)", "value": "7b2b824fc2bba663bcd69d0d08d9adb9d22ea69f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786364293, "uuid": "8976f07a-f003-4032-a790-98228bb1c915", "comment": "Malware payload (AgentTesla)", "value": "1bf724d91293f7d4a25e765da69af68cfc72355fa7e5f31b1e8d8cd84938dc6b1489e188d3af814e155b960059262fa7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786364293, "uuid": "2845535c-6dc2-4878-9b5e-b635afe6c2b2", "value": "T135E5D5512785AC327331AB9C523ADDF0A90A615325D6CF1630ACF2187B6CD1BA758BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786364293, "uuid": "842a1230-286c-4472-bfe1-aaad9e132f67", "value": "49152:cqfNGfN8AWKHD5YLcN1cAkkpy+dkHowmoSEx0H+laMWC3Pxmnb8IgrGogfwNggIe:/k6AWKHD5YLOpkkQ+WmoSEx0H+lajC3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786364293, "uuid": "afda787a-5384-47ed-885e-d3fb9b8937be", "value": 3023678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786364293, "uuid": "70b0f7cd-fde9-42b8-b275-3ddabf3ba6d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786364293, "uuid": "2cc15efa-2cc6-49c0-8ba6-b7492088a36e", "value": "Urgent_Requirement.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab63de6c-9461-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786328263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328263, "uuid": "0c1dd030-b9b5-460e-a0c0-212df29cdf5d", "comment": "Malware payload (Mirai)", "value": "4846a98e33bf324302a57e6269620816", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328263, "uuid": "8aec802e-9fa4-48ca-9be9-34a5b43e6685", "comment": "Malware payload (Mirai)", "value": "853971052934e04c4063d7613fcdbb20c54ab4ee44bcfa184861b021663abf02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328263, "uuid": "08ae43ba-a8d8-4708-96ef-1f500dd15618", "comment": "Malware payload (Mirai)", "value": "9542054c8b7f61ca8d420d786ed3d2e3d908884c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328263, "uuid": "eb03b683-ce1c-4187-8c4d-d779fe34b6ae", "comment": "Malware payload (Mirai)", "value": "312ff1c2df431d6b67192dd0e5e7d3f16571de5163f5001da2c63412a68e9c33ea4aa634a2fad361423cad00d6a5c5d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328263, "uuid": "c6d2b57e-4a8d-4e79-8c6f-d9da07919c75", "value": "T16CF2F1AF829798B3C837C77625E75BD04A6E07A6B465FC871101F25BE9470A9F4E42C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328263, "uuid": "f1dcfbc9-da23-4d32-a573-30c94be59450", "value": "768:5wmhVBt5CxVrsvR3l/aReqdzInM3VC3yTSj5af4qJgGlzDpUYso:6QbGVrsj/FuIMFCv5awOVqYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328263, "uuid": "bc83e20f-33d3-4f28-b5d7-9db8b3cc88d4", "value": 34832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328263, "uuid": "398de338-887d-4009-9f08-a3aa43365e94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328263, "uuid": "8be7a59e-3cc2-461b-a820-f1741d0f34db", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b610db-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371049, "uuid": "78fee9de-29e9-4f9b-8d9f-fae9653cb47c", "comment": "Malware payload (Vidar)", "value": "ed778bcdae85fd904ba168840f8f4470", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371049, "uuid": "a96e5b65-b785-4f5f-96d0-c15b4c52f17f", "comment": "Malware payload (Vidar)", "value": "85568ec3745c4f81d8effc6cb3923dd0885e8eca665e63356a90327671cbfa3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371049, "uuid": "0419dc1c-0b3e-4b0d-bcd2-692232999645", "comment": "Malware payload (Vidar)", "value": "318b473722b79c82e2acf849745db28f55081154", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371049, "uuid": "e9d66e99-301b-4d22-9422-87a7431ae53f", "comment": "Malware payload (Vidar)", "value": "6d8cd1201dd5419530d920e41110d2214b259272fefbb7e4460dd2ee46afa489d9d931f33b84c1d81d91a86c0bb7e4cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371049, "uuid": "9b97baba-9380-4607-8fc4-6c059afb9389", "value": "T1EE4219C573A5E1BCC46F4238EEAB09775A26340903138AFF7B9984D13ED3341727A669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371049, "uuid": "09bf6d32-9622-4416-a3b0-4790b112c378", "value": "25141296cd904157b75686c0bdb5f4b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371049, "uuid": "b8d0877b-5c24-402c-ba86-0978b7f400ff", "value": "192:OM3aBCkd9QpoJ/bNj6+VJEGkG6Z+tsth3VPU:O5BCgVRNm+V3kMWhlPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371049, "uuid": "64ed59fa-e3e4-4bd0-9603-1858e0d1e142", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371049, "uuid": "4b8cd77b-b71d-4fd1-a61a-afe3efb96737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371049, "uuid": "44014ef8-c67f-489d-ad58-691c61c2c38c", "value": "85568ec3745c4f81d8effc6cb3923dd0885e8eca665e63356a90327671cbfa3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5171ca5-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383657, "uuid": "50dc4c32-d874-4753-9389-55a34372b352", "comment": "Malware payload (Mirai)", "value": "a336c25fb38e0edf9a654008ca0125a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383657, "uuid": "fef27317-b4ee-4fb3-b3b3-1c5719badfb8", "comment": "Malware payload (Mirai)", "value": "857db7302db0b9c8494e87465249d46e78274f597ce1f6fa40fcb244eb613e9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383657, "uuid": "719fa1f7-01f8-4adf-8ae6-c49943575dd3", "comment": "Malware payload (Mirai)", "value": "dcdd667a84140b8573bb4588246db8bf610c55cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383657, "uuid": "5e32297e-4d26-400f-b34c-d4ee15737a9f", "comment": "Malware payload (Mirai)", "value": "af24eccea4e9d450f432365205ac5d138e8ad164c1bea5b6d905f28e3186c69850d6d5d473faa4535f73ca90e94c37f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383657, "uuid": "131eda1b-dccb-4828-83c2-b7df431f5599", "value": "T154E34B13A58080FDC49AD1748B9FD13BFB32F89A1335771E2B906EB12D36E616B49781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383657, "uuid": "b8ca1125-21c5-4dbf-ba02-3e8e4851f277", "value": "3072:IvsWFFL3GaWVrAqjFmjPPcIGFpLhKdYBoa/fYHHJEbq1b4P:I0WiasrAYI8LhK2HwJEbqZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383657, "uuid": "33c78100-81de-46fb-a776-9e14d05d576b", "value": 149784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383657, "uuid": "6e288601-63e9-48fe-a442-d7dd77a31a39", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383657, "uuid": "3ac7a82c-dfbe-4749-8ba8-d78ea24376f2", "value": "disconnectraw.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e689e582-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371741, "uuid": "25094b81-d7bc-44b5-8602-54b2dc9c317f", "comment": "Malware payload (Formbook)", "value": "99da88e7ae61041b6522da43e13b1cb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371741, "uuid": "b2b747c9-b06f-4224-bc66-a65f08c2bb2f", "comment": "Malware payload (Formbook)", "value": "85912783b7b4046f6b305ebc421130b0015d335624f16f49c471b23ab8ae79d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371741, "uuid": "e07dd097-ea88-4f51-a220-bf808cfa87d4", "comment": "Malware payload (Formbook)", "value": "8e9de5d0cebafe2235108e642e88e49d9cabee97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371741, "uuid": "97d93a0d-187d-4ec3-b05a-44ec305e44a4", "comment": "Malware payload (Formbook)", "value": "96460af24d9b3ffc025bfc6a3593a1aade4565958f21880b451a22c2b2e62f5bf3e9f19d4e05084d55a13b367cf58690", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371741, "uuid": "bc174618-0307-4150-ac13-87bdbcb64897", "value": "T11425129D695AEB07C24563380BB0F3B5533C6DE8E011E3269FD9BDEBBA23A544D04583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371741, "uuid": "e6549f8f-6668-4409-836a-3fff36f8588a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371741, "uuid": "3b4b0fbb-069f-4d7b-945c-7fbe682db732", "value": "24576:BeQMuH3Z7Zao6rrHcIRz998/AXf5rw70WT/frVMRoT:BvMuZ78rDcIfuof5M7nTr1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371741, "uuid": "607d29d6-06ed-4b5f-9ca0-303ae17e5b8b", "value": 1022464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371741, "uuid": "d057c0c9-6365-402a-9a1d-45c0ac6731da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371741, "uuid": "0fe88ea1-468c-4660-8708-3eb029cbbd25", "value": "85912783b7b4046f6b305ebc421130b0015d335624f16f49c471b23ab8ae79d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f18296-94ef-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1786389007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389007, "uuid": "84000b2a-4f9b-422a-9ba8-6567c009b8fa", "comment": "Malware payload (NanoCore)", "value": "12d68bdcb0237ab0268b6e3a8f1b894f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389007, "uuid": "df04775b-6506-4e99-90e8-5cc686e0b10c", "comment": "Malware payload (NanoCore)", "value": "85915561f854b2443c197b6b440425c440f85baad1cabb573a66c2ed39af3e29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389007, "uuid": "2e170ce3-d4a0-4f13-9270-a5cd277a0356", "comment": "Malware payload (NanoCore)", "value": "12732662a728b6d49c64adf97819ba983a627a4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389007, "uuid": "2abd0bb3-ab90-42cb-8d7d-690582e62262", "comment": "Malware payload (NanoCore)", "value": "ba93784fc1381755b663e73e367476301120f75db6d809f1a60e9e33319ed9c9c1d24c8eca4a04ce927ab30eaf029da1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389007, "uuid": "c9e9dce9-a1b3-488c-92ba-a6f73b2db005", "value": "T1FEA4026A77A8862FD6DE853920124217D7B8C2FBADC3F7DA149854F34B232E14A170D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389007, "uuid": "0beeba20-c551-4870-ba10-500de4589eef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389007, "uuid": "1871b247-97ce-4db4-81dd-6224097cc856", "value": "12288:8LV6Btpmkj8JBIjyXMa+GtbKALn8V1pbrQrBK8J9R:OApfIJIrSbKwnGFQlvJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786389007, "uuid": "01712ad8-970e-42b1-886b-fb47f06f84ee", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786389007, "uuid": "ab535105-118e-4dc0-a887-27c60ccb4264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786389007, "uuid": "6c7da110-4955-49ac-9af5-6251f2fee487", "value": "12d68bdcb0237ab0268b6e3a8f1b894f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3650fe1d-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786373593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373593, "uuid": "ba7ac65a-a803-4718-a58c-88ae97e45604", "comment": "Malware payload (AsyncRAT)", "value": "f655e9a77d781ee236ad1d95d12a97e8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373593, "uuid": "8b7aeae4-3a0e-42aa-8230-b773f8f9e2d9", "comment": "Malware payload (AsyncRAT)", "value": "859d606859f4255cab3cc0ac1de12567fd6f872567f760cfaa09278c56462c56", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373593, "uuid": "d2bb30d4-dd3e-460b-bdb5-4ffdaaee9523", "comment": "Malware payload (AsyncRAT)", "value": "67fa00a8c59f75c5387555612bef1dd468a0f87b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373593, "uuid": "32ead5ec-31d5-4894-991d-cc6d216c67be", "comment": "Malware payload (AsyncRAT)", "value": "b30c20d373b2b8e2618366633d3f73cc8541c01db6f2a73213c4cd9d1935478bf7219359f23fb98b189fca7798b95476", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373593, "uuid": "e1de240f-72ba-4e1f-9b99-4f05363d10f6", "value": "T1DE05E16919178603D4B26FF44D72E1B0577A7CAAA231C61A6FDA2CEBB57B7007C04327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373593, "uuid": "45d0dae4-d107-4231-91db-bca3117d1783", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373593, "uuid": "88ac2a6b-2f5e-4de4-aaeb-cadad6ce92b4", "value": "12288:IWSWToqsgOn4qnRj6ft2sTJXzxzX9EfGo96grcq/TPwT466onNFBHYL6:IWSpnjng2idzOfGyV/z+0UFBHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373593, "uuid": "ea2ac979-893a-41fb-8d46-87c3145d4253", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373593, "uuid": "8c2619e0-6dce-4b04-990f-f63979271f6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373593, "uuid": "2b335d65-39c9-49f4-8020-a224d40dba90", "value": "859d606859f4255cab3cc0ac1de12567fd6f872567f760cfaa09278c56462c56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f834ca-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786356835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356835, "uuid": "c6e5c422-0614-49b4-9c1b-ca045875474e", "comment": "Malware payload", "value": "c81692b67cef88548a874d8377b44c58", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356835, "uuid": "8b076f9c-9963-44c2-bff6-cebd96a8a739", "comment": "Malware payload", "value": "85ee6a5c52f8af675e380b046a01c6b04be998d929618193123f648d50fc3812", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356835, "uuid": "a5af436e-7626-4b48-829f-75860ada6cc4", "comment": "Malware payload", "value": "e420075b5090b7debe7bfd9fb1b92e2bd10a4469", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356835, "uuid": "b8f4dedd-799b-4ae7-b90b-eeb605d36635", "comment": "Malware payload", "value": "9ead5f8d4b4c6068e955d80fbf11fd0c620ee4f94913d5cbf9a07f4db798b20ee9d1bd4465945f5f19ec907b7e593e29", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356835, "uuid": "dd948552-d8ff-44f0-b291-9d334a1f58be", "value": "T188F08CC8066A30351BD3AA0B1336CC84F7A4D499ED630DBC0C8CE9D2B8A5C60586CEBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356835, "uuid": "37323bc6-e543-496b-b456-fd52e13a99dd", "value": "6:lOnFflE0F9FziMxLFziMBviMuiMGcbnMAMQrAdavPcbZus+D5MAMulmAC5Mu8:v0FDzRSTNnrC2XD5N7Q5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356835, "uuid": "ee9684e8-f727-4c97-a4be-3571df106e4f", "value": 473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356835, "uuid": "f79c9c2e-59b7-4828-abbd-ac61c9cd2534", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356835, "uuid": "47727dc1-0784-4296-a767-7072cbeabdff", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0ba780-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786369553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369553, "uuid": "eeece6d4-f914-4c28-8cbe-e4ff52c9ab23", "comment": "Malware payload (GuLoader)", "value": "690dbabf9a87707e5484b5c1eb501a44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369553, "uuid": "5b5bda6a-b4b2-4cf4-b3c9-cc3ff64c095a", "comment": "Malware payload (GuLoader)", "value": "8648aaee28f16c8e253ff50ebe3c0deeaf6e9a35b5088f252d2594e532f587f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369553, "uuid": "b5b7a923-9c76-4e44-b2a4-47beeb83072f", "comment": "Malware payload (GuLoader)", "value": "b30dad2efc716300305311aa77c3ed7258e420e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369553, "uuid": "6f16f6f9-75db-4984-b8d9-415d12b15101", "comment": "Malware payload (GuLoader)", "value": "69b77ed0179d2fa0dd1ab3cdcfa44a13cbe34f4a3748601f08c7921b89ebe62825b7b7c2e00b1332c141098a8cf1e400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369553, "uuid": "4d49de64-3cb9-42bd-8027-d7570797acb1", "value": "T18A84F1017614E62AD9A68A374C1B97E60B60FE580B505B177254FB7F39F3702DE0E38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369553, "uuid": "ca417618-46d8-429a-a0f2-dca14284016f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369553, "uuid": "25ce825e-f63a-4d59-933d-905421bc9ae1", "value": "6144:e6bAcJuMn7pb+YwPk54PCHw6SP19yzFBAkbJWrGjEOPXkEcVenNI:9bNKu4PCHwrbK1VsVcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369553, "uuid": "aba3046c-3485-4b28-91c9-b96a51a5a73c", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369553, "uuid": "85d45627-4fe2-4d93-9277-12e7c7d42659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369553, "uuid": "7e3b1c8d-7534-4d88-a854-565d6e0b5429", "value": "8648aaee28f16c8e253ff50ebe3c0deeaf6e9a35b5088f252d2594e532f587f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff981a1-9505-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786398520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398520, "uuid": "00fdef2a-4dc4-4265-88e4-62159011378f", "comment": "Malware payload (CoinMiner)", "value": "4e13b5835a5d12e0b6099b88292ff0ff", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398520, "uuid": "af4cb396-0039-4e56-b7ea-35ed72173731", "comment": "Malware payload (CoinMiner)", "value": "866d659393017609c685b1c0187f13a4afdf43a4b8139275f1487a2187303d41", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398520, "uuid": "87751589-aebf-417c-9b98-a3c42f2e73e3", "comment": "Malware payload (CoinMiner)", "value": "c445bd832786c794b03aa4c2b7cdfc5628801823", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786398520, "uuid": "047652d9-df6d-4c1c-bc36-fc154250d5a2", "comment": "Malware payload (CoinMiner)", "value": "aea5dc868787568bcb9b1dc483db8b13297521b73f886804793d0dba349cb4e0111cff11a2b91e47ba726022618842b9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398520, "uuid": "ec5cbe4d-12a7-403b-a979-4e92f8b73406", "value": "T1E73633D265CB007AC442C7B4C656B07C717A3B898A723C1777EC7A248E6BB29293D3C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398520, "uuid": "61f8973b-7234-423e-83bc-300d57bd462e", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398520, "uuid": "ccd8c97f-2ee0-45e0-84dc-d57091330887", "value": "98304:zWTGeP2Vi4Lx7By+A0pMgBnXr308USgeoP0suSwsvsTkuJvchEzRHpaszbO:zWMr7syXQc5ofuSriyqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786398520, "uuid": "5997dbae-abfb-4069-9c11-6afa0c8d9fe4", "value": 5209600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786398520, "uuid": "fdb582d3-4088-4800-b6cd-7dda6f4e0be7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786398520, "uuid": "b0fa3197-ea60-45ca-8a97-6d2d4e8d2621", "value": "866d659393017609c685b1c0187f13a4afdf43a4b8139275f1487a2187303d41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1be532-94bc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786367456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367456, "uuid": "f85569e1-8b57-4ac9-8745-b398c2c37138", "comment": "Malware payload (AgentTesla)", "value": "020374cdae3bcca1cefa8f98ca81876e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367456, "uuid": "3be7b032-48ba-4391-a1b5-74c09ba740fd", "comment": "Malware payload (AgentTesla)", "value": "867e698f133f0dfdb9d99eb6bbe3d9552735ebe379bf5b9f4600a1c863a5d56c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367456, "uuid": "ed8c6392-04ab-4503-ac2b-19f291436f77", "comment": "Malware payload (AgentTesla)", "value": "b2ca81fa2becb2a4521edcdee8c238b028e54b19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786367456, "uuid": "beb780ab-60f3-41ca-b920-cfc86bce06a7", "comment": "Malware payload (AgentTesla)", "value": "2b1cfa88d2090ab2feb52699d31c94523d6d30ad82f4737831699cbfaa0eba752a5a7e9bafd05e75039e95d882444624", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367456, "uuid": "f3481e40-298a-4eb9-9ce9-d63b59cf2a61", "value": "T1FFE52A8526D9AA737331AFD9823DECF0D50E862324458B1174ACFA183B2DD49B758B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367456, "uuid": "c80797d8-224a-4733-baad-3715381dfdb5", "value": "49152:sCROTp479VGZpMpi0UTLrXhtTI6XZFH1iG1hQe7rM2mxyi+21bcDZqdizopAkhe8:xOTWVapMpi0UT/XhtTXXZFH1iG1hQeny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786367456, "uuid": "1293963d-09ce-4f02-8a86-88e35ea530d3", "value": 3021862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786367456, "uuid": "e3a3e6a0-eee1-4695-8246-80922ffdf503", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786367456, "uuid": "acfde4ca-ef0c-4265-a729-93d892131851", "value": "SwiftmessageCopy10082026_pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd0ca46-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786370920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370920, "uuid": "35233050-2e1d-424b-bf98-ecc112db95d2", "comment": "Malware payload (GuLoader)", "value": "959b979590021ee9c0e1e7ccb610aa4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370920, "uuid": "d82ba885-8829-4361-8db0-49fa7cad8ae0", "comment": "Malware payload (GuLoader)", "value": "8698a2bb4ff21a5bb6c6f7cc43dbaf13827cb8248014377013a0f3daaace67c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370920, "uuid": "9dc46f91-3860-4730-98c8-579f33776779", "comment": "Malware payload (GuLoader)", "value": "5664db0dda33ad5cd12d7579ae53074b884cd343", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370920, "uuid": "fa2e1bcc-eaa5-403f-89f2-7fcfa8ab3cda", "comment": "Malware payload (GuLoader)", "value": "6328cdf3145d38d49c91e04dfe6467deb403654e8c2e2bde669a6739bf75c9eadd7570623fce5ab961e7bce4ac7c8795", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370920, "uuid": "21db1d14-6602-45e4-80b0-8ea166636bae", "value": "T18F94BE23F654C986D85023F04C7FD86A22676D7458A3560F3DAAF33D6EB3292F11724A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370920, "uuid": "eb12994d-c012-47b7-9c2d-f5f8b439de46", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370920, "uuid": "3a6bf8e2-9fe7-4471-8758-d5259b74dd63", "value": "6144:CTA8oPSCIjT6W7scfdwQf4iTuDf2eBN1UglPPG2QYnu+jR1Z+:CTA6TPIGwJieBwgduAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370920, "uuid": "cc703ded-aad6-4e95-bfea-18d7e8fdbf7e", "value": 446032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370920, "uuid": "cd43d024-0375-4439-89cd-b9f3737caaa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370920, "uuid": "34e4b803-33f6-449b-b91f-14f308c4544b", "value": "8698a2bb4ff21a5bb6c6f7cc43dbaf13827cb8248014377013a0f3daaace67c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d05358-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786368755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368755, "uuid": "093473aa-e230-41bf-9b09-f87fc7c78cc9", "comment": "Malware payload (RemcosRAT)", "value": "264bcfa559c722a3f321083cbd500cf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368755, "uuid": "fe55cab4-0b17-47de-8054-bcaa6d8f55d9", "comment": "Malware payload (RemcosRAT)", "value": "86a9d7bbfd120217bd27921cdf336aef9d11ab5c1b2d4a247cbff4f2968e0c4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368755, "uuid": "bf251688-e667-452a-8202-0f264a9a186a", "comment": "Malware payload (RemcosRAT)", "value": "2ceb989dfe1401c7783129e1d19c461310ab12b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368755, "uuid": "1af41986-4b5c-457b-a478-40f673c3bd15", "comment": "Malware payload (RemcosRAT)", "value": "8ef9fead75667084e90cdcb7d366e3d8984d82ca7cb316c0627aca49f48b8366974e24c7bc48865987f54309aed45980", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368755, "uuid": "3a631da2-ea06-4136-bedb-3bc519b3a7cb", "value": "T1E9452354A7D8D12AC8A2833827B5E23054753E4DF635C334CFDCBC9BBB65B8598A0B85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368755, "uuid": "64e59b06-0148-4d6b-b6aa-d7c4375f5123", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368755, "uuid": "9a29ea4e-fdc3-4572-964a-b8cb3d9306b4", "value": "24576:/nLQ4qNBq4S+Ekfmetc8yZzAEJjk5LwpRjLE4ZbBHFZes20Yfm:/LQ4qbvdJme28mzxJI5LyM6/eFDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368755, "uuid": "496df8b1-a29d-459f-8f3d-e34913d8b26c", "value": 1260032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368755, "uuid": "81d58e57-a167-4bdb-bfa9-06417c135382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368755, "uuid": "ea5658e2-1106-42c7-a2e8-b337b312c89d", "value": "86a9d7bbfd120217bd27921cdf336aef9d11ab5c1b2d4a247cbff4f2968e0c4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047bc2eb-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786373080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373080, "uuid": "da42ff6a-2a88-4f45-8a2a-953048f7ece7", "comment": "Malware payload", "value": "c91e9af1219e8b19955fe4f1e5084ac6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373080, "uuid": "6f517822-019b-421f-ac3f-23bcc40d497b", "comment": "Malware payload", "value": "86e9c66af38c4e1016009b17ec9029999c7ca309a635104fc8da33317a86b00e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373080, "uuid": "3048a172-9fa2-4219-8bd2-db0e8d91362a", "comment": "Malware payload", "value": "f93949c0f39f6eefe98b0794047237f5b16f238a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373080, "uuid": "5dea4925-4e8c-4715-8efb-7e885c930c34", "comment": "Malware payload", "value": "c728c753407babeef45f61dc1959c7c6e9814f3a7636cb06f79cd75850c1bebfccebbe4c4818d4e0bc6e889ccd0d8bb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373080, "uuid": "bad50465-65a9-4e26-8cf3-3030da49aa2f", "value": "T146F7338053568651D1CBDFF9217E1EE3AD3B0DE0B629A0AF06624472F5A98B7C9CC14F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373080, "uuid": "a24e363e-2c36-4289-9857-de2dbac3896d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373080, "uuid": "534c98b8-538f-41ab-a6aa-930319508bf9", "value": "1572864:PLdk00Hz0uSFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7W7:P2U5aABZVPArg/bXeB7W7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373080, "uuid": "8dde7417-f456-47b9-8986-6bfbbbf79743", "value": 73083604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373080, "uuid": "8d13e173-4817-47ce-a594-e611943746a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373080, "uuid": "fa98ef41-0c31-40f8-bb4a-1f862a48ec40", "value": "86e9c66af38c4e1016009b17ec9029999c7ca309a635104fc8da33317a86b00e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473f4877-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Tofsee)", "timestamp": 1786369327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369327, "uuid": "0aa3179f-1156-440d-a8c2-250fb473cbe4", "comment": "Malware payload (Tofsee)", "value": "74c69359bcb6bb285e786ff2a2c50d7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369327, "uuid": "7b51af0d-d90b-4958-a801-b613b22b6ce8", "comment": "Malware payload (Tofsee)", "value": "87537d77b9cb04af349eb1f9aeca278501482b54722d2d3801f90253b58f1bbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369327, "uuid": "b1dee875-f874-4a7d-b125-b0a621d1586e", "comment": "Malware payload (Tofsee)", "value": "cc63bf3f3a360aa84adfa710b5396c99523a8188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369327, "uuid": "34325a03-0f69-479e-af3a-758eb6d41743", "comment": "Malware payload (Tofsee)", "value": "4d6b3e5da877304cb37af06157a83fb8f42ef07db43dba34d7ef53f8741968a74b76670e5ef71de02de911ddcc793f45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369327, "uuid": "6cff04fe-6a15-4066-84e3-7ae92ad8dac1", "value": "T1E8C6E02369452039E2AD17357A76DFE0A73B6E90681E8D0FA6F0347DCB351E029366C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369327, "uuid": "048746c4-67d3-4c43-b077-f4d0c2ae9e27", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369327, "uuid": "257f1d72-36c7-42c8-b119-caebac12abce", "value": "98304:qoJJqUfbatOwMlvace/2BtBjK65FxIGf9Ax:p15wMFe/SrfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369327, "uuid": "7382db6b-bae3-468c-8a1e-f9435ea020d4", "value": 12380887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369327, "uuid": "b3e6319b-ffe2-4eae-a766-61d636ecfdd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369327, "uuid": "2c412969-8131-4658-907d-b05989f49d1e", "value": "87537d77b9cb04af349eb1f9aeca278501482b54722d2d3801f90253b58f1bbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8670bc-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372615, "uuid": "6ea5e33d-a3a7-4f29-be98-9a8213372e78", "comment": "Malware payload (Formbook)", "value": "ff51b0cbc5929b65e0ff470b3c25cdb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372615, "uuid": "3cfb8b77-e99e-4685-a2ef-83bf25d2dd53", "comment": "Malware payload (Formbook)", "value": "87691458306e42eec95b219e128eeeb3a7dbaac2ad595d173823840542df9ccc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372615, "uuid": "5bb8d221-f9f1-45e4-a5d7-404b670555f6", "comment": "Malware payload (Formbook)", "value": "a88d641ab198405d17c27ff4de5adcdbe843c9db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372615, "uuid": "78653a72-e013-4f19-a745-389bb11347d8", "comment": "Malware payload (Formbook)", "value": "c0bf1a58673ae69c2c56986411fd7278ea78cd86b21617adf3d75a956c3e901f0ac439d024e3591ec1969669dd19c410", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372615, "uuid": "4199949b-97c1-4783-a167-495475fec39f", "value": "T1D135F1242217D802D1D6C7B3F8A1D7B422A54ECFB9D2D2875FE93FE7796A3C21990241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372615, "uuid": "24d27d7f-d7bb-422e-bd3b-be26994bd97e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372615, "uuid": "04ac7e90-4425-4274-9e65-74d002e4b738", "value": "24576:ep50xc1fqOLKhjVQq7koAKAntNtSRscOmy5cjoA2ywwgg6LDl4:epN1fbKhjB7k6ytQpy5cjfrwwel4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372615, "uuid": "b77b0bf9-675f-48b3-86e1-1ae025ac0653", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372615, "uuid": "15cc6598-0393-4aba-875d-b4565d66e894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372615, "uuid": "98e360ef-f7e3-4ae4-b5c0-0e1fa988181e", "value": "87691458306e42eec95b219e128eeeb3a7dbaac2ad595d173823840542df9ccc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ec3e37-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371826, "uuid": "3d222fb1-a579-4c6d-9007-ed2c4bb9a128", "comment": "Malware payload (AgentTesla)", "value": "602ce630a197ec799e26673ba393ce40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371826, "uuid": "05fca600-d63e-4663-b48e-e4cc3f8be17e", "comment": "Malware payload (AgentTesla)", "value": "87a2f6b337cdbc7660306c29fbde194f7b7c9c3ceb3c9b600f8cffe4f7032279", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371826, "uuid": "ef4a557c-9047-4baa-9e98-b50150b6d745", "comment": "Malware payload (AgentTesla)", "value": "b2d48c86c49f0e218a5f5508333aa312988829d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371826, "uuid": "cee0a7c5-0d09-4428-a314-c07fb82847f6", "comment": "Malware payload (AgentTesla)", "value": "027668d3229471be17a545baabf201cc480e478035ccb2cc365d5d2b0b0e0317728958b7ce8e6d7c76ab8586ff2257d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371826, "uuid": "6410b49e-13d4-4e2c-952c-7e416a26555c", "value": "T1CD2513596907ED03C50407364971F3B522BC8FEDA942D267ABCC6DAFB922B89DC90193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371826, "uuid": "cd3422a3-1cac-4e66-9998-311ce4e9ddbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371826, "uuid": "8a0fe9ca-e2c5-47a2-8e21-9e967fd04237", "value": "24576:5U5LAeomAYk/+i91K65z8uA8Hk8QZeJBbHO:a5Axn/+s466uBkIbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371826, "uuid": "b905a83b-c568-4679-bf84-d382f287e1df", "value": 983552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371826, "uuid": "c77f09bf-7638-4aa7-9d10-4c2a10d28413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371826, "uuid": "90ea1d62-6ab6-4827-bb99-e3ec0cd08d5d", "value": "87a2f6b337cdbc7660306c29fbde194f7b7c9c3ceb3c9b600f8cffe4f7032279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8f78a0-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371916, "uuid": "8ed2b3a1-655f-4caa-9bef-a3646ee04a0f", "comment": "Malware payload (Formbook)", "value": "7dc933a2821e9c329cd6abb9de82f7db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371916, "uuid": "3ad26908-85fd-4715-a718-ec068c14b8e9", "comment": "Malware payload (Formbook)", "value": "87b6afb53d95c2d6cab996658c903eecd4c1f7c4f5dab5dad4949aaccce9fd67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371916, "uuid": "16ca0507-9da1-4261-a6dc-dcee43e4e5ea", "comment": "Malware payload (Formbook)", "value": "70538b8de5fe03412e9c74969eceb210f74e549f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371916, "uuid": "a8aa6037-bd63-49c8-a6bd-67b127a77301", "comment": "Malware payload (Formbook)", "value": "332d08b08749d0ae09c37fd273ef39af6d9056e6353e2a9b0300df89caf820ca01fdab2a428add4b4046b3ed5efc6fa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371916, "uuid": "b1184b92-17bc-4ef8-afcf-1776dce20794", "value": "T1C2251298134BE507CA421B395DB0F27852A84FDAB113C62B7BDC7EDBBD35B5A0D84182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371916, "uuid": "f3b8f6bd-1ef2-47cd-ad33-a71875871825", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371916, "uuid": "0e53ab2f-1d0e-4c9d-b623-42e12baf64fa", "value": "12288:C3VlJdbfPSLtVRmKu2TGxpshjV76Kqt+wz3wCe6rRsI2ViMKHV71Xj03PyzXbB+P:Cll4tu32KShjg+wm6SI4iMS1z0EsrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371916, "uuid": "e8e06ca2-e206-47a1-83d6-e0e9443140c7", "value": 1036800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371916, "uuid": "2ecd9748-e433-4970-a3d2-41bf53e4d24e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371916, "uuid": "658fbdc5-66ff-4a16-9e64-88bd2efaafde", "value": "87b6afb53d95c2d6cab996658c903eecd4c1f7c4f5dab5dad4949aaccce9fd67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1164ddaf-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368807, "uuid": "a0f4b2b2-61c9-48c8-bd64-ba2a74c7a91f", "comment": "Malware payload (Formbook)", "value": "f715494192d8893b623e732a602ae938", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368807, "uuid": "26f5e833-f82d-4b73-81b7-c490d2d4591f", "comment": "Malware payload (Formbook)", "value": "87bd19813c653c980443a5b51bd0569d1e9e206e4e116c2d59b1e6398b99d9fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368807, "uuid": "bd483c06-9089-4d96-a388-9f2ea0bf06dd", "comment": "Malware payload (Formbook)", "value": "b405532419e938f0b787fbef2830f3ba9a2a5899", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368807, "uuid": "a451282e-4ce6-4cea-8467-4828745de39f", "comment": "Malware payload (Formbook)", "value": "eb15eacf228b1b3f81c3e61ba8bbd6828197e30320f1f1d0d61d60a4be2c85e8d1f5ffd19db5d3677831fa0f8e5d072a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368807, "uuid": "8467a33b-4419-4ac3-b205-93d14bc4c142", "value": "T1112512406685C922E0F647708EB3E3B287713E5ED118D22F4EEC7DEB70B0B865650A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368807, "uuid": "d696825f-fd63-4231-9165-24fbdb55b82e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368807, "uuid": "3213d26e-ddd0-4c3c-b77f-2e55d23f9899", "value": "24576:fQ45lLi9qPHNfXOZh9EFpNVK7Ru6FFyX3NutTbkc:fQ45lsqP+qFDVCuiEX3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368807, "uuid": "e5fd0fa7-39ef-4265-be8c-50bc9d72713d", "value": 995328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368807, "uuid": "d826615f-1b4d-49c9-8f37-7d6804660d2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368807, "uuid": "2d1ab512-61c5-4985-82c6-8bb5214430d3", "value": "87bd19813c653c980443a5b51bd0569d1e9e206e4e116c2d59b1e6398b99d9fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1ab2aa-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkCloud)", "timestamp": 1786373977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373977, "uuid": "4ae81f5e-64d5-47d9-bec8-52acdb63a398", "comment": "Malware payload (DarkCloud)", "value": "935cdf813e9fed1079507ecfba8b5544", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373977, "uuid": "18563b76-1909-4322-84bf-208dd64c55ac", "comment": "Malware payload (DarkCloud)", "value": "87bfea1c2005742e5d6f6f11fdcc33585d74784f45db91b518f77df3e54e6621", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373977, "uuid": "c2736205-4f9c-4043-b632-b003bcc358b6", "comment": "Malware payload (DarkCloud)", "value": "a0515c54a58050366c49d9c2e85fc0ae437b3c31", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373977, "uuid": "b2da6cc5-dca2-4d21-a94f-046adf219893", "comment": "Malware payload (DarkCloud)", "value": "d91f8a6efa6cfde7f9ce8f91c2160ebfd09c8e367300473baf145c8497a82e5bdba08558cbdf37cb3254efc655bf9291", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373977, "uuid": "a2eea28d-1715-42b8-a5ec-1afd073a872d", "value": "T18855E084EA844660DC6A9BB12A37CD3147333DEDA830E51D29CE3DAB3BFB7961025553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373977, "uuid": "b5cb25cd-3334-492c-83bf-4c839b138031", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373977, "uuid": "3b4d57b5-3aed-4c70-96e0-d745b49ac1bb", "value": "24576:MYFqRzQ6Kk5ZMj5BnVPO/g4HUVHx0OphTDV3WQVe1q:/f67W9RJO/Kx3B33Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373977, "uuid": "64a7962a-7e07-4a65-bf7d-7c93791696e4", "value": 1398272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373977, "uuid": "6259d9d9-67dc-42f3-9506-5855bb70393e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373977, "uuid": "f350ba30-f0a1-4ae1-bc1e-b849ccc9e809", "value": "87bfea1c2005742e5d6f6f11fdcc33585d74784f45db91b518f77df3e54e6621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992551c1-9490-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786348419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348419, "uuid": "a834f055-71b7-41de-8290-617c85a02ea0", "comment": "Malware payload (Mirai)", "value": "1b2c0e113af7c9aead2460dc08d1ee85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348419, "uuid": "ca92094f-26b1-4e4f-ad7c-aa9a9aaf265c", "comment": "Malware payload (Mirai)", "value": "881d5a6b504c1b56324114757c4cf27cfd41c43ed49804eca0f1c5500bafedce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348419, "uuid": "0abeb90d-b700-4bc8-8410-df1c43c98402", "comment": "Malware payload (Mirai)", "value": "99bb5bb2595038d6414c5dea3e6f283b92763b39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348419, "uuid": "8d3f615b-fb75-4491-882b-e26fc77c73bf", "comment": "Malware payload (Mirai)", "value": "b0d02a7c7fd878385a17ed6b919984955c2d5c9cf04ac35137681d16494bfa7f12cc1b9f722d1cf2b5654c130a90698c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348419, "uuid": "9eda3251-c551-49dd-ac71-aaa8a07c8130", "value": "T143B42965FC809B91DAD12ABFFF5E824973131B78F2DE72129D051B2163CB84A0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348419, "uuid": "7107e10b-6b38-4aeb-91e7-bb3d9271e758", "value": "12288:TjnlAxBK/BGeadYWp3LX4nsXunT9oxfN7Zg1uvjaOA/dFESb1vT3x:flyhmoVvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348419, "uuid": "7f444cb5-8021-447c-8460-a3b470767520", "value": 497344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348419, "uuid": "bccffa82-522d-4947-b23d-67cbf9f88ec6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348419, "uuid": "4b6db1ab-d731-44f0-a00e-e3cebe954e76", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0cc7ee3-94e2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786383677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383677, "uuid": "f1d7835b-4ec3-4c06-a71d-c2364429cd83", "comment": "Malware payload (Mirai)", "value": "a678fa133093e9e804f9077ddc704524", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383677, "uuid": "b2d62b69-d80f-4510-abec-e5d440da8b6e", "comment": "Malware payload (Mirai)", "value": "88c2184f05094c2e3adea9fc8861e87e80b4e51c14d6e093e8447250c950949b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383677, "uuid": "1467ea00-4e8e-4f96-b570-7cd7989dbabf", "comment": "Malware payload (Mirai)", "value": "5e26309f460859c82029a02890cb1d8d28a76a4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786383677, "uuid": "e7618214-3eb8-4632-8b3d-d56ab3aeed23", "comment": "Malware payload (Mirai)", "value": "faa8fe7d7c6549bd1e349a3b1e9fbac8c81c22a03d858d9d1942ce96a3f9555db8a4019d8e10282df2d3eccab66849d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383677, "uuid": "e8c4a393-be6b-416a-9e81-929e7a9fb3ad", "value": "T13D343A8ADE650FEFC5AFCE34065E432715ED999B93F0A336457CDC48768E20846E3468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383677, "uuid": "77eb8169-4e2d-4637-8282-fd3a197affaf", "value": "6144:DTOxo6movXlQYx1x2iq21qqBj8Lsz08PdvrQlm+YsMv6myjDj:DTM/lQY4C8N8PdiYT6jDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786383677, "uuid": "fca82eeb-8641-4e45-968d-fea50c7613d1", "value": 249564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786383677, "uuid": "6fd32c97-db23-444a-b2c8-43f65ccdaf91", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786383677, "uuid": "e95b1aa6-e03f-4995-9e4d-67abc8412e91", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47bd7ab-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370342, "uuid": "e6789eec-43a8-4ac6-b398-6832f6aedd98", "comment": "Malware payload (Formbook)", "value": "a50e74d44e5206f6b7e554013fb2cae1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370342, "uuid": "c7bf818e-26a3-4f38-83d8-29ab40a8263b", "comment": "Malware payload (Formbook)", "value": "890499482db9f8777c7fb183fa4d72db6d1b6f4fe0326ae851a5e659d6d99a23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370342, "uuid": "75a54810-6979-494a-a624-c5671b0a9394", "comment": "Malware payload (Formbook)", "value": "351510977c0da401f59f616070919c37f8167d0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370342, "uuid": "a91ddef0-4083-40f4-acee-2c4e23dbf239", "comment": "Malware payload (Formbook)", "value": "4a89e09e77a58d649e59bb638ddf59565bc5b11937ee79b580fd7f243bd5be03a5bd6aee5f534d87255a8f1f5e6e116e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370342, "uuid": "b898e7a3-2501-4b04-9d31-90c9fc26e902", "value": "T1BB3512942F4EC801C4A25735CEA1E3F912B62D9EE532C6038EEDBDE739762075C25B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370342, "uuid": "25dd2312-75b1-4827-ad23-e3b45930134e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370342, "uuid": "f36262a7-978d-437a-bbac-ee7387508cd1", "value": "24576:cKlCvg+Phf4oqOpp4/MWrkeZ8sF4cvBmAsf0PvTg2gdmNvTdMr:cKlCvg+Phf4rOpp4/MzcNF4cvTPs2gdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370342, "uuid": "135eea9d-5a61-4873-be51-bf64a5ddbd9e", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370342, "uuid": "7f854179-7e01-436a-98a8-354bf07e4bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370342, "uuid": "9b82a742-8b6b-4a43-9189-b56fc876dc48", "value": "890499482db9f8777c7fb183fa4d72db6d1b6f4fe0326ae851a5e659d6d99a23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce0bff7-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786372155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372155, "uuid": "8dfab6f1-de33-4396-83ca-361e67ba4fb4", "comment": "Malware payload", "value": "5e1e2487558059f8b1595e341c2eceb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372155, "uuid": "ba1781a3-0644-4417-b3c4-9311991c7c24", "comment": "Malware payload", "value": "895bc3129be3d472b73f493895b2fd6f974f9706e266539751ec0f97b5e741d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372155, "uuid": "d07399d2-06ad-4e30-a359-1d61a832778d", "comment": "Malware payload", "value": "26d6031b7ecfb276e943d086e8d846629dccb6ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372155, "uuid": "cd521e16-7d8c-4a6a-a7c2-a032d98c8bd9", "comment": "Malware payload", "value": "6ccbdf63a84ef3a127706594c1cc3010ee308ecc914e41183f2e896af58a1b9701b449c66f7610f2e6a73331925d62ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372155, "uuid": "4c577691-f6dd-4b1b-abfe-577cbd9a5947", "value": "T10E833825F1D901E6CEBF72B874368BA6DB3893E551144209CA8CB9B93DFD31044B0A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372155, "uuid": "e9c519d1-bb13-4e74-89a0-9bf4d56ef0c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372155, "uuid": "926e78dc-6349-46dc-95e5-59bf1651c0a9", "value": "1536:7bm1Qs1WyY/URBNwC9+S7XVTy1PJe5a1DIKxJVzpArePK6CtTvJsANVR5:7bm1QswL/UrNbUSrcyjR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372155, "uuid": "9e4e5446-eb2e-49c1-97a2-4d2ee45416d0", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372155, "uuid": "1d976bed-9260-4ac0-8121-3124bcd504ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372155, "uuid": "16bf2252-f4d9-43ce-b50a-8dc7e60e1ce6", "value": "895bc3129be3d472b73f493895b2fd6f974f9706e266539751ec0f97b5e741d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d05a7d-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372594, "uuid": "638427db-4702-4ada-8dfa-5e61f9e51658", "comment": "Malware payload (Formbook)", "value": "c8304651b0f64e249462e2d40e579f77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372594, "uuid": "7be4937b-b391-4170-914c-7d4f72263fa0", "comment": "Malware payload (Formbook)", "value": "898b7431c629070487a6c67d88995fbbb9076869d2de5b6845244f86c598a28c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372594, "uuid": "841d231f-4450-4ad3-82b2-0c6c363476b2", "comment": "Malware payload (Formbook)", "value": "896f315b215d5f480edb9916f9b392bae489df57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372594, "uuid": "3775b5ca-60ba-457e-8e9e-86292f72af17", "comment": "Malware payload (Formbook)", "value": "62ffe0ce2203c9c9c8cb1afc04f97a58af03653233a14489071618d421d12a7d2388624bd3538238949ea6c8318800b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372594, "uuid": "692e4265-6147-4d7f-8c24-cc2a4ff4b429", "value": "T13C35F1045717E802D0D187B7E8B0D7B432A84EDEF9D2C2976FEA3F67792A3D11594282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372594, "uuid": "853c6668-d945-407b-9288-1baa0572a3da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372594, "uuid": "f03c4b47-890b-4c64-9c7d-1adc3215602d", "value": "24576:C8hvp503ZSLMkfsviLkxNyI7PyYsmbvC4sNry+g1FfUlI3f:lp8SLMkfsaLkiI7PRs1bty1FfUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372594, "uuid": "7738ec75-6df1-498e-a35c-c971f724149d", "value": 1142272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372594, "uuid": "d3e0ed9b-75b4-4f05-8d11-c8bd8d63b7a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372594, "uuid": "92f4fed9-9e66-4bf9-883e-386d289ced8b", "value": "898b7431c629070487a6c67d88995fbbb9076869d2de5b6845244f86c598a28c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8baa1af-948d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347183, "uuid": "25a30a1d-0fd5-4b80-a90d-ab32d8a80eb4", "comment": "Malware payload (Mirai)", "value": "b42a37e6c1cbafdc5d4287b0cc63de37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347183, "uuid": "598ee8f4-daad-438f-9425-471862e2f05e", "comment": "Malware payload (Mirai)", "value": "89b4a1ecfb1f6ac02f9bae48ca1086752646004da5039fb5cea166325a92dd86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347183, "uuid": "0f1d8610-2664-4b2a-96ae-c07affb2da94", "comment": "Malware payload (Mirai)", "value": "3531d0c6815720c799c71674555e043979821b69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347183, "uuid": "0a5abd4b-464f-4980-967c-4e1b91a9b21b", "comment": "Malware payload (Mirai)", "value": "f185de19695bcc6924ca4a1f03b45ed5323cfb083bf00bfdb7340ba3d53bc48549d67f7840809e7df4d67a092a2e205f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347183, "uuid": "0b4693f4-5f46-49ca-82d9-f64476a85a3a", "value": "T1CAA3A71E2F619FBCF7A9833487B74F34A65823D122D2C584D1ACD5042E3435EA91FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347183, "uuid": "e4bf6964-800f-403f-b980-0617308dbd90", "value": "1536:9N/rBcOxCSW0QWSgpUHmJ71YRIDR3e/1Ftf3QZEpx/L1PAbSPIaV64Db:7BgH0QSJxYQR3yFtfMwx/h5Ijmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347183, "uuid": "8542389e-d50a-4626-b07b-535a36210a03", "value": 103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347183, "uuid": "8db5c365-7f58-4e9d-885a-e816eb28bc43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347183, "uuid": "cb4f6e97-5282-425d-8526-a1377b372d27", "value": "2EUE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9672f293-9502-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786397377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397377, "uuid": "c59872bb-b8de-4339-a366-75e04db9a9b1", "comment": "Malware payload", "value": "d82dfdb1aa44ae7e2fb90bcb9d492a45", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397377, "uuid": "9763951c-8b61-47c2-a8f2-0b1afe781a48", "comment": "Malware payload", "value": "89b5e19f4d9c535a5259033d35f8b69c7fb66a147e57af41d0abff643019447f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397377, "uuid": "a44e4aee-c93c-4100-8e29-0ec54f955caa", "comment": "Malware payload", "value": "c8f68771a25675036e51c418c7c94b5a0ff79ecb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397377, "uuid": "408ea289-8b39-4ec2-9dc8-483eac1a904d", "comment": "Malware payload", "value": "60a3f1c17bc0176030c3a188a721d52a19ccec7812ce70f62e6b9ed89589802793235acedd5d101541fb4fd5f3e3e25d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397377, "uuid": "01bd0693-9f63-44e5-8bb7-d7232d31f8a8", "value": "T1B2235C6516867C24AE98C4361C7E2F0CB9AD83E6324452EE7FCF3CF68C4A69D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397377, "uuid": "7ea49a6e-7209-4c91-865c-5fb63abe8d7a", "value": "768:A+N9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:A+Ocr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786397377, "uuid": "4ceb41cd-0a0e-40e1-8c28-c1e19df20ea4", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786397377, "uuid": "5eaf510e-9e91-4c95-aa50-bd14d0551ce4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397377, "uuid": "9b6f15d2-9bf9-49d4-badd-c36d714051ec", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90019db4-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1786372026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372026, "uuid": "60ef7bf7-9312-4859-829c-c30ff23d220e", "comment": "Malware payload (DarkTortilla)", "value": "3af10088b300f65db5db0389919c9138", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372026, "uuid": "c3e9f4fe-83a3-498a-9018-f8c54048dae4", "comment": "Malware payload (DarkTortilla)", "value": "89c3dc480c498b02017a7facd801102364434fd2fc2e9669ff8283b8e648ce39", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372026, "uuid": "5cbaaeb3-237e-4aa8-9037-243c5b0939d5", "comment": "Malware payload (DarkTortilla)", "value": "1b053ea979587461c63aef16e41b506206bfa46d", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372026, "uuid": "7347b606-f459-4018-bdf1-27ac8b21a323", "comment": "Malware payload (DarkTortilla)", "value": "78616eb305743987f925cd1ef5429249adf111d47b4af5d05f3b7bb2455fc07a0efb6cc9d4c303feaa29ce3ae08c58da", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372026, "uuid": "9e8299aa-cd99-4228-9c21-40ff08887a9d", "value": "T12345022DCDC32B44C67E1A78C15648AC33F09F17E2E5EA5B2FE900F58B92568DD264D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372026, "uuid": "c3b2c790-bd91-4500-8669-29156e48882f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372026, "uuid": "4fc85d29-0f66-4c98-9002-b8f87537c52f", "value": "24576:KSckHlVzaqMH/qCzcMLqpJ/EHbMWus6HzL7Ew2GClGZ:fFVm71s//WuzHzHEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372026, "uuid": "8b83ebb0-31d8-455d-a9f6-e7c4b349ff07", "value": 1205760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372026, "uuid": "7fe15a5d-b526-4838-afd1-224bfc26de58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372026, "uuid": "2552df60-4e6c-4e25-8b75-ab46b9dbbba9", "value": "89c3dc480c498b02017a7facd801102364434fd2fc2e9669ff8283b8e648ce39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63fc080-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786370855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370855, "uuid": "fc3c7e9d-c0a4-474b-8647-f6b1bcaf6819", "comment": "Malware payload (njrat)", "value": "72810ea66266438a5658b6883b31aead", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370855, "uuid": "190b2c0f-454b-408b-af27-fd9876eb9361", "comment": "Malware payload (njrat)", "value": "89dde821c9a2435b5c800ba381a1b80f949642760e23583c35c2132c071457d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370855, "uuid": "d8c606a9-d457-4ea9-a224-0aa00fd0c799", "comment": "Malware payload (njrat)", "value": "02f40a8e4ff6c4f700d77d224bd38403fe1b9f13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370855, "uuid": "b4f3dc09-a049-4a86-9d93-6de27e9f629b", "comment": "Malware payload (njrat)", "value": "3d844833860d9f62720e95d8ee1734c4a52d11885e8f968df861e2e1b2643c46e7fc218e8309045f261197390034ad7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370855, "uuid": "0f4ad56e-0ace-4901-b452-4d1ec43e8822", "value": "T181150188231AEC02D5A25FF11E70E3B451B91E84EC15E313DEFABDABB46E2853D452D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370855, "uuid": "faccdfa6-d544-42fd-87e9-fc18bf5fc3a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370855, "uuid": "e9b0446c-eaaa-49fd-ace7-002b8a4901b0", "value": "12288:BNe0/fJ6L9FOdMpC4PthQmKGFCJ65Whqg5KYZBF0xsCOhesmmwnaKMKWj:BtR6pFg4lfKLJmW4kKYR0BOcsKMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370855, "uuid": "5f381fd3-573b-49f3-a465-cec110424271", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370855, "uuid": "6ac8b73e-64f0-4a8f-82b2-7c5a0be3b94a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370855, "uuid": "08fcaaaa-093f-4675-a828-326a0b2e9657", "value": "89dde821c9a2435b5c800ba381a1b80f949642760e23583c35c2132c071457d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627ca0e4-9460-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786327711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327711, "uuid": "9d37a3d0-42ea-4cf7-9642-928932320e3a", "comment": "Malware payload (Prometei)", "value": "cc23dcfdbba5bb8f7987ae709e3559a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327711, "uuid": "eae92484-20f0-4400-a2e0-8e536e1ac15f", "comment": "Malware payload (Prometei)", "value": "8a0aa04876b1221d0330ddfb7a4153c80e9eec24dab9c1fc2801fa5a14076ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327711, "uuid": "fb24e327-e912-4f28-97e4-7ecab3a59aee", "comment": "Malware payload (Prometei)", "value": "6ece81ae575977eb112f31e3877b5225dcbd102f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327711, "uuid": "7cb9ba51-07fe-4411-801e-cc8153f80f47", "comment": "Malware payload (Prometei)", "value": "1c69cc87f0e116128f800cff548868c75caa372aa6c1c106435fdc02481dc74ccbea13d0005a3084d1ec933154cfb169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327711, "uuid": "e0d88ef6-c9c3-42de-bff6-f1a840c726a0", "value": "T1BA34F13668B83F14D423B679720B1F3281F5571F3A3B156CFAFE4BB2B1646110A6358A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327711, "uuid": "ae6d6384-e038-4445-91ae-999b08ff3dfc", "value": "f418afe0379776397753ae40798cc2e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327711, "uuid": "216df8f2-2de5-4f9a-96fc-0abef27d3673", "value": "3072:FjYKz0b1fne3uapce5iUOIHJRsoIWl2oPlO72vGvW246N6aPGjgpdSVife12u7XR:Cre3NpGUOcnsoP9AjUOxvSVey7Oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327711, "uuid": "a40bb0ee-7431-4cbf-b19d-9c02b33b408f", "value": 248416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327711, "uuid": "99fccc88-8454-4de6-b6dd-4d5ba957197b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327711, "uuid": "81692177-442a-46e2-bea5-c13d65bf9694", "value": "8a0aa04876b1221d0330ddfb7a4153c80e9eec24dab9c1fc2801fa5a14076ffe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8f9aba-94c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786369949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369949, "uuid": "6fa35f95-c68e-4f39-bb99-53a5a588db87", "comment": "Malware payload (Efimer)", "value": "ec77c59faaed22b4fc25a4dce40e681e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369949, "uuid": "caff96f2-7fb5-427b-8faf-0434fbacf35a", "comment": "Malware payload (Efimer)", "value": "8a0bc5750ac5616bd3a688d540d68f8f231774e0718cd5401601fce7d8cde93f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369949, "uuid": "cf793e85-a1b2-49f6-9293-ff99cede5ee9", "comment": "Malware payload (Efimer)", "value": "15ce9dc5036f332b33094761d27c94877e23e6c9", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369949, "uuid": "ed4476cb-24b2-4167-af6b-8b3ccf4bcbe0", "comment": "Malware payload (Efimer)", "value": "0a1c3e942194c08d8e7e9602ac8156d6f7896134238d7407439cfed1359f5b155e4b67f359f22f0e0e0ad967f84dec4b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369949, "uuid": "315d5081-7480-4cc0-921e-93d4d6a40309", "value": "T1A9E6334CAAF012BAF9F35078BED21155F531F0661B72C9DB9B989121AE233E04E39717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369949, "uuid": "04951d87-3d22-4b80-8c2e-2692e797c90f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369949, "uuid": "0685e54f-aab1-45c1-85c7-dbda7d50bc5f", "value": "393216:aVdEdo9Pe/aAq3qQXRWb3XMCHWUjcDcuI3/PGTAI:aVdbPe/azaQgrXMb8cgH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369949, "uuid": "df048598-cbc8-4b82-a965-9a32c09518a6", "value": 14080399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369949, "uuid": "52f0cde7-6cb0-4ca6-a965-12fab52723c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369949, "uuid": "7b751e74-4221-476e-b592-9aaaa0f23ad0", "value": "composer.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa70df20-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369493, "uuid": "d3038e9c-fc6d-4999-8b6c-be4cad72be61", "comment": "Malware payload (Vidar)", "value": "a18939b7fefd9da799bffea07ab63f45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369493, "uuid": "42071cc8-e453-4d5a-aab1-80e218157736", "comment": "Malware payload (Vidar)", "value": "8a9f82d0e899775ad048140a0f385309a9f560cd8a909cc2e4b71b76709cb52c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369493, "uuid": "b70063a8-0cb1-4a61-a1b1-c5fad5fb659f", "comment": "Malware payload (Vidar)", "value": "da38b96ddb9f3915dd53c62410aa854f3ea4cdd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369493, "uuid": "74b955b7-18a6-4a4a-ae95-98679ab1f90e", "comment": "Malware payload (Vidar)", "value": "ced77131f563eecb6e058b9c71801e4b7f25f8000c97f08ef8da808c5c5fb14adc3263da6930b813781845ebb5b2be85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369493, "uuid": "79d3dc2d-5e47-49fe-864e-601a783755e6", "value": "T17562D69F7197B0B9D1F4833D8B8E12B3D663708A071A5FBF95DC86442AC176026FC252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369493, "uuid": "25d67f3d-9fbc-44a2-b838-a945b5b7e34c", "value": "e489cd9c73beee1db4c320380f37924e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369493, "uuid": "1274acba-4ef2-4b5b-8f1c-dbe92d101654", "value": "384:OkXm9zFUcz8RQqUHvvHS6qb3HUo8qyNTLGygHli:B+8RQjHvqZP8NNTLCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369493, "uuid": "c92730a3-a564-41e3-934f-59469bb6747c", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369493, "uuid": "03decc20-919b-4ae2-bedc-c0675bc039aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369493, "uuid": "523dac99-c9a9-4581-a1bc-7602e7318201", "value": "8a9f82d0e899775ad048140a0f385309a9f560cd8a909cc2e4b71b76709cb52c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d135dbb-9513-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786404636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404636, "uuid": "22202471-fb07-4bb2-bdcb-a5b8d7ff132e", "comment": "Malware payload (Mirai)", "value": "593625970b6e5161c1bc6a8193413012", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404636, "uuid": "a307c796-c21b-4575-940f-b1a1387a92a6", "comment": "Malware payload (Mirai)", "value": "8b0e129a647a6ccea436f6d16d3043337a723fe48bf19f366e22e7e5149500a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404636, "uuid": "50c0a863-6352-416a-99b4-5959e88d71ff", "comment": "Malware payload (Mirai)", "value": "084df6a1125e9ac4c44af8f9450c003ff66f0b8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786404636, "uuid": "e43a77e8-8087-4523-9962-7a7ee8182d84", "comment": "Malware payload (Mirai)", "value": "774e7e372a498f499d0a6c9dee7911e97d4739f32ae182047fce9e49bd4f4f2e0b3624cdc9cee760e4331f35dfdb04f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404636, "uuid": "b78277f8-8539-4f9a-886e-2872ee80234c", "value": "T1E823E556F4D0DE62C6D43179FA5E119C33674BB8D2DA3202CA207A3537EB56A4F3A902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404636, "uuid": "69939661-32c6-48ad-9109-a6b4a98596c9", "value": "768:mWuWOhERu/31/slD40y1fGQam2OC8oAPf73Jpos0sO/VCAWxp7bPxHokV0keYxb:mVWOpEW1GQBhC8oIpROfWxp3PxHoZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786404636, "uuid": "dd1cd4b8-941f-4ecd-9a27-23a3250e397d", "value": 46360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786404636, "uuid": "7e2f9020-4f04-403c-8c27-892e1466799c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786404636, "uuid": "14bc5b98-ce4b-44d2-b2bf-0cfd995b11be", "value": "mini.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad27e92-9487-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786344395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344395, "uuid": "99351218-b4be-463d-b917-324b0d979977", "comment": "Malware payload", "value": "07a17db0788dedb2ed49576b34c645d4", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344395, "uuid": "0143ce1f-bba1-44b2-9a0b-4693ce4d494d", "comment": "Malware payload", "value": "8b76fd02f22106d80147453a04a123c6a5aee8b5677d9fae1843b46008638c0b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344395, "uuid": "416f792a-b489-4ffc-bc1b-ab7b6e713be1", "comment": "Malware payload", "value": "6ec5343d33b8f17831f9664b877ae049be6b804d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786344395, "uuid": "e02c6ffa-fda4-4f0c-a4c6-957e5ed81a4a", "comment": "Malware payload", "value": "b861bb957bc096375cd09bef13785fe0b71357155e870abcadb575286ab8cf957ed2e0e16c71686661f2a4c3cbd5e5bf", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344395, "uuid": "40628af6-3e98-4475-bd91-1b8922b8e52c", "value": "T1643207CCAF9063F4F29743CD27AF299D136561CB504CD880F68C6DE06F4B68D4A86E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344395, "uuid": "fc06cc64-4f1d-4e3e-bbfe-666bc68a972b", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxz/lX42AiYOpzfMnJbl9CX:sXX+/DV7k/3/lLAiYOpzEv9CX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786344395, "uuid": "01150afb-e2cb-44d7-8386-c004a0d2290b", "value": 11935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786344395, "uuid": "2111ecef-97a9-4cf8-9f01-e173dc5511b7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786344395, "uuid": "f5c65f64-8548-457e-9a97-850be82dcb4a", "value": "cy4509Report.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdbdb82-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1786372696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372696, "uuid": "86193e72-0821-4975-8e64-fe493db12406", "comment": "Malware payload (RemusStealer)", "value": "e8f8eec7a53912e4accd0cc821f0876a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372696, "uuid": "31c33987-2afc-4f31-928b-e3095b563fe1", "comment": "Malware payload (RemusStealer)", "value": "8bb8f109254d65c31232d0dc68a37fc2832bd919eff95d7fbe0b2a7317c1e1a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372696, "uuid": "4369c33d-1264-408d-a83f-6d2f9afedced", "comment": "Malware payload (RemusStealer)", "value": "de54455a1e4f9816d725d3124f49227883da50cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372696, "uuid": "399c2cc1-0f8b-4c4f-8b81-6d3bb4b78960", "comment": "Malware payload (RemusStealer)", "value": "8c0f86f3314b640491d4260d6c9611a1fb6cb7905c7cae6a1a76c0e3b437a3e81bc827358ed81a2fbe39e49bb1074886", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372696, "uuid": "cbda92e3-e229-42c3-810a-64ad74dff0ef", "value": "T1CCD54A07FC9149F6C099A33189B29256B775BC090B7233D72E90AB383E767D09D79B24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372696, "uuid": "e3e8e80f-fe6c-4c81-9eb6-1f92ed31c65a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372696, "uuid": "48851342-962c-4ded-babb-29596ecb0510", "value": "24576:O5HW7bI8o8p6kPohIHoConQvfoEqXBR6YXW6Rky2aso/9zk8vAoBele5I9DPKf4m:O5Hm08r8kw+HoCoufn4DjkfaxkPVDul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372696, "uuid": "e3e123f5-e29d-4f62-9dc7-8363397a3a2f", "value": 2815488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372696, "uuid": "c4d8439c-6f87-4a9d-b40d-4cf2ce29c2d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372696, "uuid": "7142fbdc-ba1a-4e82-aa2f-25e4f6f8b8af", "value": "8bb8f109254d65c31232d0dc68a37fc2832bd919eff95d7fbe0b2a7317c1e1a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650653f6-9495-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786350479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350479, "uuid": "61e88f3b-1e23-4fbb-b02f-86bb7f72a774", "comment": "Malware payload (PureLogsStealer)", "value": "94c5cce8d37ad06a46fe80f6c4545a9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350479, "uuid": "f02a06e0-7706-4475-b50d-ffe3b6be503c", "comment": "Malware payload (PureLogsStealer)", "value": "8bf9292268c54bff715ea2840a79a77e4d7517b0e3f825c0454cb3607cebc6ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350479, "uuid": "e6f9210b-d4e7-4f2a-9345-000c8979b522", "comment": "Malware payload (PureLogsStealer)", "value": "73de2d6a8a8b25816fa0f25bb20fd938d21fa856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350479, "uuid": "66461623-b8b0-47e3-872a-1bc9d0f958c8", "comment": "Malware payload (PureLogsStealer)", "value": "88a72ebb44892669882c948734abb87a2fa1b07b3d0348fa28cab92cc15dafaffc3f6edd598f1ff8bce9525d6b2454a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350479, "uuid": "9d2ca117-18d0-434a-9160-7e73bae39fc9", "value": "T1F17522BC6E5EC810ED990BB10BB1D37115384E8CE512C2A39FFDFDB77865B2A2844985", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350479, "uuid": "a03f7ae7-d402-4d38-bad7-8a1fa030683b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350479, "uuid": "aff8fdcc-ef3c-43c4-a18d-9f5a45f086e5", "value": "49152:wAqU0q3rbbwhGjYCsYGsPh5T5FhUu0Ux5WN:7+q3rYGMC15Pn5FDzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786350479, "uuid": "4705503e-4737-4930-a3af-b44749b53afe", "value": 1622016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786350479, "uuid": "c7c77e1d-8d55-47c7-b78b-53d1cb7b11c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350479, "uuid": "8e278b99-d85f-4d07-a258-ca1eb5be6e23", "value": "Email_20260803T003229_3124512.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ecbcc4-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369079, "uuid": "819b9cbc-be55-4b68-99c2-1466f1f366a9", "comment": "Malware payload (Vidar)", "value": "06766ccce738f33943ebd12342f035b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369079, "uuid": "78155301-d60b-42e6-b39f-7f2771abc174", "comment": "Malware payload (Vidar)", "value": "8c65fdf81f36fde8272baf6f993dbaaf5b1a75602b2dff7d6bc90ff91c965c61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369079, "uuid": "fa1c2104-efd2-4d90-b248-242120b59ae3", "comment": "Malware payload (Vidar)", "value": "b5d682ae0d9bb0c9b02a6bb6414e973189465840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369079, "uuid": "e3c8ef24-e299-4400-acc6-179ddcc1221a", "comment": "Malware payload (Vidar)", "value": "969625b123819fe08c36bb6c3ab0ee528b0e881ae6cf4c4f9b0b9a3bbac579728fcd99f141e2771ac552ae364755616a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369079, "uuid": "1cd39c2a-069a-4d6a-8ca7-5175ca3ad2b3", "value": "T1D85219DAF18372F9C0EAC339D7161377D6B6348D170A2BBF96D8D6A829C031039D8694", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369079, "uuid": "bec8853e-58d7-4b8d-980d-d50bdf337b71", "value": "1bbed67eef2c885e172f4ab0f7e6b4df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369079, "uuid": "9d4ca89b-bca5-4e65-a5fb-11c232a1c59f", "value": "384:OjCqraQkgqkfUuTU5sNzvzQdeyeTlDNfDZ:8CvQPUuTU5EXQd7WDRDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369079, "uuid": "8391c603-ba8a-451b-a5fb-cfd117412298", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369079, "uuid": "1f9ed1e5-9c0b-47af-9080-e59991a060f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369079, "uuid": "62faedf4-3c09-4034-8457-25d6f6275ece", "value": "8c65fdf81f36fde8272baf6f993dbaaf5b1a75602b2dff7d6bc90ff91c965c61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac5417f-9461-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786328315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328315, "uuid": "6046d6e0-9105-4a75-ac46-224055d4983b", "comment": "Malware payload (Mirai)", "value": "3e0bd3a985bc9e0937b35c99e92173fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328315, "uuid": "41766ce0-cfc8-4af2-a00c-35d9dab64358", "comment": "Malware payload (Mirai)", "value": "8c95dfa95220071f3984c3158ee101597f53b6a1d1c092d07ba852f3ff37089a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328315, "uuid": "570aa843-d48a-45fb-983c-2d43ba0c2bb0", "comment": "Malware payload (Mirai)", "value": "bfabb344588f43940ace42df3416eece7d1d2e4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328315, "uuid": "a91f49b8-e460-4727-9f8c-2f156a3edb07", "comment": "Malware payload (Mirai)", "value": "ec3d8027b05e44059ca4a3edd3591ffede9e05fd31447f56edacd8527d0ec0dfb31a7768aaed5a6f916169138dafb4d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328315, "uuid": "f06fbc05-5b0b-4065-86db-3d847bd01080", "value": "T14C83A61E6E219FBDFA68C23047B78A21979C33D627E1D685D29CD6001E7034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328315, "uuid": "d055df7b-1a5b-4711-b5c8-089e84289765", "value": "1536:rYM+VffRbU4YnVviHdy9BeBcwCcTgee8ns5RSld641Ri:rD+fpbU4YVedEeawz2zEd64y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328315, "uuid": "f5c3bdbc-a7bf-4397-bbc8-15eaefe6a38e", "value": 85188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328315, "uuid": "5a2a58db-dd7a-4a78-b490-06cd15b18e1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328315, "uuid": "d201a87a-744f-4c3a-919b-dfeae204e4cc", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ea52bd-9502-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786397379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397379, "uuid": "2a364fe7-6b08-4279-bdab-e91fe849be3b", "comment": "Malware payload", "value": "848a746701f2be308d8979659b1fe23c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397379, "uuid": "80f63a78-55dc-48db-b036-deb9816485be", "comment": "Malware payload", "value": "8cb2c2eb8547b2c260f4ab8facd603e2bd3ed4001119e708501acc3394e0840e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397379, "uuid": "c526506a-d0da-49da-a5cf-7caa74a37bbb", "comment": "Malware payload", "value": "2bb03598e9ad4eef66e688c45db0ea0afce40957", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397379, "uuid": "8cfe42ec-d914-4f9b-9996-9178ed6ac2e2", "comment": "Malware payload", "value": "9c38fab26d171a557140dbfa8f50790b4f6277103ad7dae6829622d7d579552b4033e4eb3651a7e90a6c8099f1ee0828", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397379, "uuid": "c3a4fbc7-a58d-483e-bc33-3732f8252faf", "value": "T1A213D882F347D922C40A193567BAC776370279F61F66D2108D65EACCFB6B6C0A9B1423", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397379, "uuid": "c8206ee2-3ebc-4050-abd7-f1c76bd4273a", "value": "768:evsma5fs3nd1LMDuF+/uASaNk2qh6Y9QRDDvoWwyOofUEuGlAbihUvf+wGatzFaO:e0pNkXkJ/cEuJnvfVzFaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786397379, "uuid": "b8453a52-cfb9-4a1f-834d-544580631af5", "value": 44484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786397379, "uuid": "78328d4d-b11d-42e3-b632-a2cbc2ea8355", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397379, "uuid": "1c379d7b-383a-4ae1-8f64-9feb8a04f20e", "value": "main.armv4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eddc3c5-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786373339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373339, "uuid": "aa26e485-dac4-46fd-82e1-5328d7f690c6", "comment": "Malware payload (PureLogsStealer)", "value": "85efc9ec248b184396328f830e18876d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373339, "uuid": "531663ae-8561-411b-90aa-cc32da5b5091", "comment": "Malware payload (PureLogsStealer)", "value": "8cc5ec8d9d99816bcc21534baecacf44630d23b788da4d90ff298ce061202ae9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373339, "uuid": "1a18928c-d2b3-47c5-9008-7d99c5f0c6bb", "comment": "Malware payload (PureLogsStealer)", "value": "c1dfb9ecafb4ebf3ae55b27c367d385d10b03ae1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373339, "uuid": "98a61131-24f9-4a01-84c1-37d38fb2992a", "comment": "Malware payload (PureLogsStealer)", "value": "8f247b354252cfb16f2f61c075d63de51bf8a08717daac68e3f636b13ea43068ba3ae642c46b20639dc79bf1bb737afa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373339, "uuid": "1e00d5ab-b36d-4bc3-a863-f09f754b326b", "value": "T1B77512591712EE42E1DA8BB5BC60E33432704ECF79E2C3825FE99FF7741A3916958281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373339, "uuid": "9be3124b-9dcc-4ef0-980a-2430c4c90963", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373339, "uuid": "324aa089-7004-4ab4-a27b-ac37e357f6f1", "value": "24576:bp5069ln+UHSebfEzELoAO0H1+SxnjC04Qea3Sok7cnr:bpRnnZfHLGqjC2eai7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373339, "uuid": "c2f4be1e-ddda-4465-b70c-ab198525bb6f", "value": 1671680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373339, "uuid": "1c8cf2c5-d3c8-4f5a-8f53-ba1304102da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373339, "uuid": "3d623641-af3a-4f5a-8cc7-2fbc090e580d", "value": "8cc5ec8d9d99816bcc21534baecacf44630d23b788da4d90ff298ce061202ae9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7420080f-94a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786356946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356946, "uuid": "30aaf1ee-a27c-44ce-81ae-a2c641486c11", "comment": "Malware payload (Mirai)", "value": "cab076bc0796c0d2d30d17bd635416bd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356946, "uuid": "f0abacf8-3126-4f71-af30-b0182eac8984", "comment": "Malware payload (Mirai)", "value": "8d5e98c7fb4244f8f61743f04b42b514981b71c40387adfdc960207ee2e4bc16", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356946, "uuid": "13e37abc-37f9-46a9-97e1-d26db61171fb", "comment": "Malware payload (Mirai)", "value": "766b7633a6122df925fe45afed775b2e58ed248d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786356946, "uuid": "4d311104-d937-402b-ba0e-5483e84a7f20", "comment": "Malware payload (Mirai)", "value": "2e441ab040cd0ccf38dbf76f736083160fadca73256d514d0071fad0db64532ce3c6adf3e236771783707265c495bde2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356946, "uuid": "4d3f7ee6-171c-49d2-99f1-b1219e58560e", "value": "T1C544B71E6E228F7DF369877457B74E34A76923D623E1D580E1ACC1101E6438E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356946, "uuid": "87b30d12-5dcc-4250-b6d5-4fc327247df9", "value": "3072:up8GOCrKWVqw0x1QRugN80WxbfdGUmL0O43zbSIsa/gLrugP+NszaKBoePiqi4CH:upHOCrRVqY8jxbdZfQaESsk6iFL1bN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786356946, "uuid": "a8ae016a-d1bb-4737-aa43-ed12dabb8282", "value": 258580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786356946, "uuid": "c633ef7f-a110-480b-836b-fc423ebea00b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786356946, "uuid": "5a1d2c11-6447-43dd-9a97-d7de18058550", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72761f51-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786372835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372835, "uuid": "0e177cd1-44b7-41b1-863a-d678b0a7c843", "comment": "Malware payload (AgentTesla)", "value": "583b2fee229b1901d8816baaaad51fc9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372835, "uuid": "75555dbd-46ab-44be-8902-5f91c91bd0ad", "comment": "Malware payload (AgentTesla)", "value": "8db72555c4fc52ae7a756ab9868af1e372e06e3ad07ed1b80a06e0f5351f28e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372835, "uuid": "e15a8811-1dd4-4d88-9d4e-9c7ee3127b8e", "comment": "Malware payload (AgentTesla)", "value": "ddca1e972425dd576c8f144ff35c26d2d1133c8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372835, "uuid": "7016baa1-b578-41e1-a1d0-c9a4d1931b6b", "comment": "Malware payload (AgentTesla)", "value": "d6e84e79bd69b36fece73421ea298bfae75718f37dd1d97a6713e19d65d298fb0020c16d9c95bd4f6443d7bea3a09389", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372835, "uuid": "056a77da-e080-4650-adc4-39c8633003fa", "value": "T10744011637D1C87AC4A20B71C87655FA5628DEA8D93387073791FE6A7E312C28F0E761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372835, "uuid": "deb0dbc0-15ae-4200-8cfa-9ead19511ff4", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372835, "uuid": "23014c4e-f8b3-4b83-8da0-4c66407d3ae0", "value": "6144:LB+pgU8O2WlqNhtWMZg5ecBuj0fi+ZImQALScO:LgUOxlCnW8gYJeHZIZAxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372835, "uuid": "7dd0ff1a-9ed3-4460-8d70-9f4f63628683", "value": 275760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372835, "uuid": "cb8e012b-9c72-4d63-9efa-450ae292b7c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372835, "uuid": "14918963-e246-4262-866e-bc848d5d1919", "value": "8db72555c4fc52ae7a756ab9868af1e372e06e3ad07ed1b80a06e0f5351f28e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9ddabe-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1786368715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368715, "uuid": "143e0006-5b7d-405d-b3e7-baa4e33d43dc", "comment": "Malware payload (RemcosRAT)", "value": "6a2e157bdff4f7965a7b5802fee03275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368715, "uuid": "85b459d6-5ac5-4dc2-8760-b51bf972fc6d", "comment": "Malware payload (RemcosRAT)", "value": "8dba8da0a8c596b4f3a886f95c57bdb6d8b046ee356d3c52555c3bc3fb0cd114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368715, "uuid": "da211d99-9494-400a-b1b1-79443120d3ca", "comment": "Malware payload (RemcosRAT)", "value": "06c299768beea4860ab2186d64e3f408bfe0da08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368715, "uuid": "a222ae4d-6cad-4725-a1f6-029ce661bc97", "comment": "Malware payload (RemcosRAT)", "value": "ebfe43e1edac28368cde060ab7b789366554da3f029cbe19d69e6be8e675e7ac38ab9b521d2907c0eb061974d91a6b0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368715, "uuid": "7c65ebb0-c3a0-4ef3-8c05-f08a5c25dc30", "value": "T105651250E66CBDD4C97642F419BAE6304079EF2ED06E86199AF47C573AB16C330A3E07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368715, "uuid": "33eb3eff-1b7d-4222-85cb-182aaa965491", "value": "24576:VlgQ40GNwzZvLd1jQkoeczbXYgjluRb//mik7EMPu51dCsTuJ/7TNbfq1OvnCis8:V6Q40BhnRofzjYgj+b//L4EMm5Csq/7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368715, "uuid": "1532b424-4296-45a6-ad8c-361ab2a7301e", "value": 1476096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368715, "uuid": "113c45b1-5504-4bd4-8b4c-d1ba873cb899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368715, "uuid": "7111d012-dcbd-4a17-9099-7b3107e22501", "value": "8dba8da0a8c596b4f3a886f95c57bdb6d8b046ee356d3c52555c3bc3fb0cd114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf613c4-948d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347187, "uuid": "7397a780-07d7-4448-ab69-f80ce5f90fd1", "comment": "Malware payload (Mirai)", "value": "c3d6d6740564034cbfcd0730bab9a977", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347187, "uuid": "13f47974-c76b-4be3-82e2-deda6078ec45", "comment": "Malware payload (Mirai)", "value": "8dfd5cefc9c20988abb1188f250724f4fa3f46f74f1e4e8c0569b38cb0320d93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347187, "uuid": "c5094c69-9802-4562-943a-e506288e4595", "comment": "Malware payload (Mirai)", "value": "263848f64215645cc751b3645dff955d6c6d7359", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347187, "uuid": "14510688-2854-4223-927c-dbd0b56ac1e1", "comment": "Malware payload (Mirai)", "value": "c05b187043b5d87ff43997c714c558891692b051af20d9f5627807463f825b9ee4d84f19097e090442046506eb7647c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347187, "uuid": "eafa7347-1f3a-47ba-9d27-0d0002748851", "value": "T1D0E4CF9673556D3BE0A79F3F84930B12BA36E78046C337172129B6346D336B86E25783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347187, "uuid": "962e8074-4e4f-408f-a759-69ea4e9ccdd0", "value": "12288:1O+2Z6ZRKvbqJoynt8GqtI9oblHqvQdqWkMN/mnLhVnTwsZvMWyg9WaTC:4Z6ezOoyD9eKBnlVTwGfyg9WaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347187, "uuid": "2bf21d8c-e65e-4ad8-beb0-f6e9b6563afb", "value": 661572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347187, "uuid": "a09dd196-3c6f-401d-8840-69c2a8904a45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347187, "uuid": "aefcdbb0-9941-4752-990e-98b62c18ae34", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69a1276-9491-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348978, "uuid": "4df3a074-081a-4bf8-b478-b1f449f54fb2", "comment": "Malware payload", "value": "d0d8fed17497a83e9da92c8522aeff19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348978, "uuid": "e10944c6-8ff5-452a-ac79-39a2d21f302e", "comment": "Malware payload", "value": "8dfe259d2c6f6005887f2fa978f0c98a6713de17d90311b5919adbd9ad3ae190", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348978, "uuid": "ea9d305e-b7d1-40fa-a4a5-e793746cfc44", "comment": "Malware payload", "value": "0f87be817dd57e1bcb13da2067ce2a9600fe8ea5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348978, "uuid": "1ec80b8f-ae51-4b1d-af70-6666b788ffb7", "comment": "Malware payload", "value": "20a0930b477dc95afa3568263863bc0fa020fc6808b1a52b89058c4367f6e8144e69620041ddb43fc511d13dc764b9fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348978, "uuid": "ed05a33b-ca1e-41cf-b3ee-030525102c6a", "value": "T1D463E9099E15B9BBC08E4E7845BFC09204D63DBBA3D5833975E47A9DBF3C25902C3698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348978, "uuid": "3531132c-d744-4bfc-afea-4093b3cbbd14", "value": "768:oIAWciMXbWvr+mRtzrQgIXkRc527v1ZGvCiGQ:oyfxQfh27vPLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348978, "uuid": "cab31495-ef3d-415d-aea3-7b9a14b017fa", "value": 72884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348978, "uuid": "f9249e7c-157a-4f73-bbfd-5f6c136f11d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348978, "uuid": "1c244419-791b-4b88-be40-19c76b1ff2c4", "value": "main.mips64r6el-n32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400ffc00-94a1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786355571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355571, "uuid": "7d81a068-badf-4eac-bb60-909bc5394fdd", "comment": "Malware payload (Vidar)", "value": "b24376060623dd8dabec2c3dd423361c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355571, "uuid": "562b5efc-f04b-484a-9af1-c23576055a09", "comment": "Malware payload (Vidar)", "value": "8e5e251d971957c982721ef54328000815d80c744f184fac3bb1afd64dd3624a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355571, "uuid": "1cdf1790-72a2-476a-b49d-fc92325c3cd7", "comment": "Malware payload (Vidar)", "value": "2f7c74580c7031ba7d9ad89771032eca0ab61758", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786355571, "uuid": "7f698af7-6047-4aa1-bf5f-4a14dab2b237", "comment": "Malware payload (Vidar)", "value": "3745450b52dabd2b21ca49431f8205b6b61feb8e391bcbc891a585e9c4e03d145898b56e0d7e2e80be53422bf03b5232", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355571, "uuid": "b0fc3132-cb6e-4eb6-bc18-76c9f4b5ba45", "value": "T19B067C03BC9149F5C0A9A73588B74652BA74BC495B3237D72EA0BBB82F727C09D36744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355571, "uuid": "c3729b7b-a1cc-4bff-9121-693b3a9d53e5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355571, "uuid": "ce47005e-22bb-4ac0-8c30-e68f3c206216", "value": "98304:bPbAHF0b2LsXfAP0xZoXriQPZvCjMnV725p5NnkVIWsEfZw4xToOtz++W5OmaRUt:bya+W5Gktp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786355571, "uuid": "3277d27d-7415-4e49-86ec-d4f8ee825a7f", "value": 3699064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786355571, "uuid": "ed9f1eda-8f87-47a5-b8f0-f3b2abc1fc0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786355571, "uuid": "47e32f79-6502-4ec1-a312-1b8867134f4c", "value": "b24376060623dd8dabec2c3dd423361c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b231760-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786370970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370970, "uuid": "4aa5384c-3ebc-4d32-9203-b26ffc00f8ef", "comment": "Malware payload (AgentTesla)", "value": "c8e3508402e2117567e8b0665ef86aa7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370970, "uuid": "98c96186-e8f1-468b-9e4a-5e5a3a15b01e", "comment": "Malware payload (AgentTesla)", "value": "8e607bd17fe6bb0972cae7c1dd4720010f277705194f86c69ec77097c67a52e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370970, "uuid": "58c4ba8a-44dd-4de3-a870-803f64010651", "comment": "Malware payload (AgentTesla)", "value": "007fcbebcb9cce83f585ed23577670c066dcda4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370970, "uuid": "fbf1e359-ab5d-493b-a627-9d8290ff1893", "comment": "Malware payload (AgentTesla)", "value": "59ec800387c3ab307cb174aaf17e4f81efbb2e4f5d7a73153289d470a0eba9d72b9337c02babb8333b3900232bf7e37f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370970, "uuid": "9a46ac0f-6092-4de6-9f8f-6c52eb767547", "value": "T198350245335AC812C5C7AFB05E70E3B405794E98B811E773CEFABDA7B87A3866D01291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370970, "uuid": "7b1dc766-a877-4859-a65c-8cf9d54cf380", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370970, "uuid": "24d7a7fb-81f8-4f2c-bf5b-26097f3ad504", "value": "24576:c9jR6pFsRss47ZQKXW1ixC75glOudZbIZprzsmtIAa3zjuLF:6timRss47ZfXGWC7NudZcZBzsmGZzj+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370970, "uuid": "651d8c3d-6303-48e4-a619-dc4253fe1d66", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370970, "uuid": "213aaebc-159e-434f-b60e-54adef311d85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370970, "uuid": "9d945a3f-0723-4ccb-8e9e-c5d7e2d107a7", "value": "8e607bd17fe6bb0972cae7c1dd4720010f277705194f86c69ec77097c67a52e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e1245a-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786371101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371101, "uuid": "8fa91ee4-1497-42f1-8c49-b4ac2a97034d", "comment": "Malware payload (Vidar)", "value": "63b575b239158d51eb18db9ae81a16a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371101, "uuid": "3bd55cbc-41f7-4a01-8914-73a86c416266", "comment": "Malware payload (Vidar)", "value": "8ea2ff143ae5e334c59c65918271c06edaabba7175408daf950e073ce93ce861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371101, "uuid": "9863d985-6228-4e63-8c67-4a9807d7cfdf", "comment": "Malware payload (Vidar)", "value": "6bff687d583a4c6f2dd5d6467305a76aa9a76a58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371101, "uuid": "d7b7c2b5-96a3-42eb-9672-b5241b36ae00", "comment": "Malware payload (Vidar)", "value": "d4887676d9227f8fb175ffeca03bde6763dee318215daa13d9b669f72628422f67ec8f07066bd09e5100849adc592830", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371101, "uuid": "080ad73d-9fa1-4f26-a3d3-709fada84e63", "value": "T1B0421BD7B19770B9D1A5C2FCCBA716BBAB267080030B1FBF46F892845BD261066B4618", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371101, "uuid": "4c31b034-7a1c-4f0a-977d-e7691c12a80f", "value": "f6ed7a812e36f2c87231645354e7939d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371101, "uuid": "5cfba493-2a0f-49a3-b258-d98cf5535d2d", "value": "192:7X9YRDdGPmn0ovxWEV/mz5jRFpLlcPGD/Ut3N9pJqs30s3VZpCYn:D9oD2mnVvxdmz59F9/Ur9OsHlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371101, "uuid": "528db163-d855-4332-8c72-ccc97e649129", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371101, "uuid": "dfae9724-20ff-49e2-98b5-d04bd383589a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371101, "uuid": "858601aa-ac82-449a-89c4-84e3c3d9f2f3", "value": "8ea2ff143ae5e334c59c65918271c06edaabba7175408daf950e073ce93ce861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b3c2c7-9502-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786397380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397380, "uuid": "fab9985e-efff-4bb6-929c-267223505652", "comment": "Malware payload", "value": "aec8956e1abda9a15f5217b073d1c1eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397380, "uuid": "dee337af-026e-4891-a3bc-9e2bf2dd1e1e", "comment": "Malware payload", "value": "8ea859135c8fe3f92df9ef2409e6f87114050f9336cc75132c90857d619df665", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397380, "uuid": "d7b8b0d8-d73d-486f-ac53-690f4580160b", "comment": "Malware payload", "value": "69fb184a6dae43441a32f2d88789bc84bb45cad2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397380, "uuid": "65387b77-a5ac-4897-a363-c657a1daa492", "comment": "Malware payload", "value": "005157fa6c15f2400cf298726fae4d94c3763531115dc4d52ee53955f27f31e954b441dce2a9504a616e2f1d31943a64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397380, "uuid": "e227ffa9-79d2-4c25-84ab-e2b7ce8c918c", "value": "T11B25AE533BF61465D6404A358FE2D321B20AD7A874D54A4B9FA08EEFDF032651E82CF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397380, "uuid": "ed60f2c8-6e23-4501-90d9-e08d99ee9deb", "value": "12288:4hMNCDpIW1LfS96SvNzF8zlyFtcIaRava5dCYSh:HNCD1cFfFKBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786397380, "uuid": "4e2ac5ab-386e-4000-ab59-1de23d58bae0", "value": 1057088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786397380, "uuid": "c3ff0c2f-c118-4f75-90a5-d786b8660baf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397380, "uuid": "96db8617-6ebc-40f7-a5a9-e64515d25b4a", "value": "main.sparc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9872ca9-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1786373062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373062, "uuid": "606add81-5408-4e15-b3c8-412ebebb0b65", "comment": "Malware payload (VIPKeylogger)", "value": "488e7b9bbb2b6de4dec92bd97824749f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373062, "uuid": "69651553-0b73-4abc-bac8-c37fe72eb3b6", "comment": "Malware payload (VIPKeylogger)", "value": "8ec33b1e7c00648bed83da9c05914b458a25995239e61ce287e90c7c8d0b5fc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373062, "uuid": "8ffdf0f4-8272-4f63-8a38-e05fb4def7be", "comment": "Malware payload (VIPKeylogger)", "value": "d678724fb4fb5b3b66650b394c4ed6619987ce18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373062, "uuid": "9b4dadf6-cf87-4a4c-8b84-b8ea11acdb74", "comment": "Malware payload (VIPKeylogger)", "value": "7205fbf90959e6dc73bc9888bc69dd2ae9431f08485af7bb87bc017c966df405b4eeb7a0d75a1cf391d7200e085bbca8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373062, "uuid": "ccd1949d-384c-4da9-a711-6c560e34c75c", "value": "T124B5E820BFFA5874F1BF6E21CEE7B981D7EB7F725916854B2112170B09B18098F42A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373062, "uuid": "91136d77-394d-4e84-a612-4b337661c632", "value": "49152:anfHZ6Mj1gw8ul68qoRN66KUdZnEJh/Suy:anS6hdZq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373062, "uuid": "56668516-61b3-4365-8fdd-f7bfed3a6657", "value": 2449920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373062, "uuid": "7b9e6434-40c2-4ca7-9ebf-07938ec1d5f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373062, "uuid": "23e449d2-dc52-44c7-8566-b2be3e0a8c97", "value": "8ec33b1e7c00648bed83da9c05914b458a25995239e61ce287e90c7c8d0b5fc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bce766-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkCloud)", "timestamp": 1786373753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373753, "uuid": "f6a46169-d1ab-4a0c-bb11-5020bb761f1d", "comment": "Malware payload (DarkCloud)", "value": "5ea237b0675adf0432dccc7a4468bed6", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373753, "uuid": "09efa313-aa0f-493f-afce-75ff94c4e36f", "comment": "Malware payload (DarkCloud)", "value": "8edb49c430bf31464b8c083502054e7efd0de69c0fbce6681a2608109b6c1421", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373753, "uuid": "19ba6ad7-4d06-4f81-b03e-f72e5a1e2658", "comment": "Malware payload (DarkCloud)", "value": "f579d99d6d5870b3f36db57101cff3d8dda97f29", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373753, "uuid": "138ef8aa-2522-4194-b174-46beebccc034", "comment": "Malware payload (DarkCloud)", "value": "f4208bad1800fc53de56f386af2b6cb0063859adc59c3dfdcb8ad90d7f63e671c3e438efb167a6cc76605e0b6fa018ed", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373753, "uuid": "2ccad0a4-809f-4633-8228-9e19a238da0e", "value": "T1F555F0C5EA4496A1EC59ABB16A36CC3043237DEDA934D41D2DDE3D6B3BFB7821020653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373753, "uuid": "05e4f37b-6880-42ad-a3c1-7f702a102f25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373753, "uuid": "9a6b702a-6606-455e-90e2-9da1535d59d2", "value": "24576:+N0cCUb1ogjuE1165RLvtXR3GNj+WakinV+RMSe4ft7k9+gZ9L1q:3c7CgayUr5Xdy+WakinV+RMr+t7k9bU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373753, "uuid": "f73b179e-37bd-4623-b514-1e6f49168836", "value": 1395200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373753, "uuid": "e4bd00c3-5bf1-4318-a527-a087a843b876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373753, "uuid": "c615759d-50f2-49c8-98ec-c6db143f244f", "value": "8edb49c430bf31464b8c083502054e7efd0de69c0fbce6681a2608109b6c1421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a121646d-948a-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786345855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345855, "uuid": "7c6de735-04d7-463d-8029-a023ff9c5bb9", "comment": "Malware payload (AgentTesla)", "value": "486c3cbf1976b08a784af128b2cb6875", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345855, "uuid": "36447e20-7ec7-4e14-bf88-878037e4fa6c", "comment": "Malware payload (AgentTesla)", "value": "8edf0ea4a9fe03184d6525155b5ad60dd519faed49cbaa83b3103520d068b22d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345855, "uuid": "65ca4afa-c849-49e4-914a-71abda19f2ab", "comment": "Malware payload (AgentTesla)", "value": "44bff936d483cfc09cb4fc8f6db26904065dafd5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786345855, "uuid": "5c7af29b-e24c-4cb2-b605-fb6ed9e7883c", "comment": "Malware payload (AgentTesla)", "value": "36522b550c37e2991b15eb09746a331068b0c0c3260cfbd687afefd7f3fec1b3e4aae830afcaeb17dc34f5c4cb133406", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345855, "uuid": "440f31bf-b0ea-4dcf-9aa9-79d2e18289bb", "value": "T102E5B3425780AD727725ABAC523ADDF0D90A510319C5DF16307CF218BB6CD1BA7A8BF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345855, "uuid": "0a7368e7-ee95-4da9-9565-7aad0252596d", "value": "49152:ISYe9PlrUdsltCJQIFzNjofQ2bUDKuYrVwyxgJknQOthFFEEv1glF68zI1qggHkL:ke/AduCaIFzNjmvKKuYaugJknQOthFpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786345855, "uuid": "e242e3f3-f67c-4ac9-8af5-0d8993cd3157", "value": 3050654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786345855, "uuid": "d52cf32b-2a86-406d-a3ed-099b36cf46b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786345855, "uuid": "bcd7e6a4-fc99-43ba-99a0-3fc34ad988fd", "value": "Purchase Order - PO-260311305 - Payment TT - ETA.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb6e8db-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370710, "uuid": "0f9c3ebc-d2e5-46e8-8f1e-ab0615614930", "comment": "Malware payload (Formbook)", "value": "8f066542f2b0ed6af2ad95e71a771ab6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370710, "uuid": "c8a2eee7-ef1f-4d52-82a2-b63eff87ee07", "comment": "Malware payload (Formbook)", "value": "8f596a7798dfa8460b1b46881bf7362c7f714978aa4348da0d248aff75768363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370710, "uuid": "4d35723b-f9c5-407b-a546-095302fda489", "comment": "Malware payload (Formbook)", "value": "b395d6a92f53a29f2064f33b558775efc1f2aa74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370710, "uuid": "33fc71ba-9d1b-4a1a-855f-e67cb6f2777b", "comment": "Malware payload (Formbook)", "value": "8376db2faa9e605649dd6027da207072732c6417e680c0dfec175d646719f954f5c2e6fe2f7156f688440c6c24dbb240", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370710, "uuid": "530377aa-dc1f-4dd6-bc45-e491e54f9eb8", "value": "T1373512249649DD02D1E60B30A860E3F502F67E9DE821D61B8FDCBFDB7932306AD54B64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370710, "uuid": "12a77ba2-518c-498e-91d1-9b146787beec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370710, "uuid": "b8d1a0f5-455e-42bd-b2ce-2d90fbd00e74", "value": "24576:AoOI3mBDUzMCLmJpehoUwhTWF8TktkuMFdf:bV3UUgCSJCmTZktFmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370710, "uuid": "67c83d00-25f1-4e41-9471-cfbd83885e98", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370710, "uuid": "fbe0023c-5c75-4486-9a41-f51238d377b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370710, "uuid": "99ebea99-5788-45ae-b207-93ea692619ad", "value": "8f596a7798dfa8460b1b46881bf7362c7f714978aa4348da0d248aff75768363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec462c47-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786371321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371321, "uuid": "0baa1689-82f1-45e3-8c56-b81de40c91a4", "comment": "Malware payload (AgentTesla)", "value": "b0dd6c8ee042b326d6c0ab108c0bf6e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371321, "uuid": "f8cb047f-9bad-45fd-bfce-3e81dc8ba96e", "comment": "Malware payload (AgentTesla)", "value": "8fabd6235dcfbe7bf788cc58d80107727bf60e2b3410aa50b36f98659dda5c37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371321, "uuid": "ec6f6e82-1d93-492e-9c65-d3bf49935e6e", "comment": "Malware payload (AgentTesla)", "value": "1eb1baa433d9de5098c870683eab3924aa111728", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371321, "uuid": "c80e9832-9e72-4acf-986d-4eab977e1de2", "comment": "Malware payload (AgentTesla)", "value": "52cc4c3204b0f9aed10776fe11d5746bb48c3a5a042830f5580758bf932ae6528a46dfe8422447de219a3f52c66c1914", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371321, "uuid": "7870e570-8d95-41e0-bb86-e959c30577cc", "value": "T1B125125CA608E503C8861B784EB6F6B512AC3CECE951D7139FE96EEB7D36A015D402C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371321, "uuid": "10c72393-2085-487b-8e66-c4edc12d4870", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371321, "uuid": "99d35dc6-e333-4ef9-ad49-fe1765ee516c", "value": "24576:4+WsGXTDCAql13H7SYGHMiAUHWQPJKh74xuVqA:WXXCAKeYkA+WQAh74oVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371321, "uuid": "0487af63-efb3-4737-88f1-e93f6600697b", "value": 1003520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371321, "uuid": "cb18b0db-79a7-495a-b5f1-2c3548865a60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371321, "uuid": "1d2eb048-f1c1-4052-9131-37f021eaf83a", "value": "8fabd6235dcfbe7bf788cc58d80107727bf60e2b3410aa50b36f98659dda5c37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac66476e-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786369067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369067, "uuid": "a5ae810b-ff4b-40bc-a5e5-65bb14a3780d", "comment": "Malware payload (Vidar)", "value": "3f8c4f0db988a8f8cfe871f20860e786", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369067, "uuid": "a9183745-8319-4e6f-88ad-541e3a53c825", "comment": "Malware payload (Vidar)", "value": "8fc6d927272afcca4607e07bb27f1634434848bb2ccd109f2bc79e61b9313f39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369067, "uuid": "086a0059-fe76-43f4-8652-24efb70247e4", "comment": "Malware payload (Vidar)", "value": "e0bc8778bdaf23cd5eaf218278df1b9d6d6bb1fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369067, "uuid": "97cfb48f-30c4-41fb-878f-83e80cdb046a", "comment": "Malware payload (Vidar)", "value": "64f87918cea05d9229f15b228ad2788cc12ab22a641692bf972d1a1d3163f05bfdfeecc44369f6b54d6933203a25bd9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369067, "uuid": "36af264f-7b6b-4dea-970d-4c6e460c5a3c", "value": "T15A320BC723D1E0F9C36EC679A9F511ADA672300192172CFF61A4C8952FC721273799AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369067, "uuid": "23e46e63-1dbd-4034-9769-a4564f91a365", "value": "4771e6f45e35660c0a3e9d4423dc0d86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369067, "uuid": "d7bb6b63-1054-40df-a6b8-9bf24a59bbdc", "value": "192:OD9Cve/O2DR/ozqRDwthSgz+NhnnKwADij24P4CJC3VO3V:OD9C0O2dozqRa6N9bV4JlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369067, "uuid": "7fcdf07d-14f6-4d3b-8b9d-c73d10c58be6", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369067, "uuid": "56346ac0-1c2b-4e57-a6d1-3050360c2e39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369067, "uuid": "e226e0c7-e59a-4b13-9551-4f6c43e70c10", "value": "8fc6d927272afcca4607e07bb27f1634434848bb2ccd109f2bc79e61b9313f39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f611b4-947c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786339911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339911, "uuid": "7f5b96da-fd27-490a-9b7f-8b98fbdea295", "comment": "Malware payload (Mirai)", "value": "4c28519dd0e1049cc0f34b0c832e352c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339911, "uuid": "c533ed32-f143-4b13-bebc-c040ece5adbc", "comment": "Malware payload (Mirai)", "value": "8fdc0041414896914137bb860329706f2707ec88ca39be785a1c2caead84028c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339911, "uuid": "e1f185b0-4184-4c63-b9f7-85cd90426901", "comment": "Malware payload (Mirai)", "value": "9318ceb5454f7ef3cc2a668a9b7b2f491e40c4d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786339911, "uuid": "b921b261-2673-4842-9a4d-ccf4959a8cc9", "comment": "Malware payload (Mirai)", "value": "dbeb3fd852ced4a03fcd217dbb175d083c7e86eea9078a19226f35aa500df9ef11d536ee9a6c805736440db9ee0b30e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339911, "uuid": "699041c6-547b-41d9-a639-a12c1a5c3052", "value": "T1D074FB88B5F2E2CED1D4EAB5A319784D3B630336B5D73145A50EEA3312EF15809BDE60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339911, "uuid": "f3a757cb-59e5-4a90-9a49-f030b68fe703", "value": "6144:Pa9za9Na9KWyTUc7syUc5FlTY4+86uvphM4piqxxwYym2tp:Pa9za9Na9KWIbRln+KBhdVxxwYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786339911, "uuid": "3bf8e081-e85f-44b8-9687-d4441911d804", "value": 363016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786339911, "uuid": "a26eda44-88f1-4858-8630-0fde662a153e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786339911, "uuid": "e4c403a2-10a2-4e1d-a5ed-ba6a0889ad76", "value": "bot_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf23dccf-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786370816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370816, "uuid": "6dc6d11e-efb8-409e-b68e-16b98343c91b", "comment": "Malware payload (AgentTesla)", "value": "9492000215d7c92a61434efa1a5a6d7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370816, "uuid": "ae708e96-1e43-405f-98ed-a8d3255da516", "comment": "Malware payload (AgentTesla)", "value": "8fe03dc4b6ed35defdab98f794580d624ddd039c80581f92588201d3a46a8be4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370816, "uuid": "7a88d777-3faf-4478-bcbc-eda87c27a3f9", "comment": "Malware payload (AgentTesla)", "value": "aada93a043c4fd6953182da56031b1624473549b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370816, "uuid": "29e7653a-db40-4665-9f4a-54c43df3c990", "comment": "Malware payload (AgentTesla)", "value": "42ad28b920029da24c8ed896f1e0f6d4428416679d9db3b2861ad368713486a34f39fe1f4717aef5835d0ad1baf78365", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370816, "uuid": "0e36b7fe-4928-4b55-9ea2-11ef0006031a", "value": "T12CF55B70D351B065D1A7C430CECA4EF4A4A1303B52366D1F1BC5D91A25FBEA1ABAD3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370816, "uuid": "36bd5069-7f2b-4511-88f7-907d839f9601", "value": "97694f39fe306148caaada69136cf645", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370816, "uuid": "df8014c6-4078-4f30-899b-4890c3fb1f36", "value": "49152:5MtK6O5+7JkgRNTLCOBR7OpMSr/0U3WtHHfClA9NSclaDHnz1hcW4uuqb:HYT3DtHRlarcwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370816, "uuid": "672a2a3d-c380-4d49-bdd2-15fa97b54068", "value": 3546112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370816, "uuid": "9e8df1be-6431-4963-901a-c40309a0b165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370816, "uuid": "4c143856-f4e7-4e75-a202-fdd3960947c1", "value": "8fe03dc4b6ed35defdab98f794580d624ddd039c80581f92588201d3a46a8be4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b22da4f-9490-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348422, "uuid": "ee046483-c169-41e6-bcf3-fcae21b290cf", "comment": "Malware payload", "value": "105d6a6c0c003182c1180088561a80e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348422, "uuid": "90e3b121-11e1-45d4-b399-3cad1b2bd70c", "comment": "Malware payload", "value": "901b53814a743b82744f72a295bb621cba81f7b54c2a30b43e358db606efa29f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348422, "uuid": "d67c8935-5b7d-4572-8a7f-3b8d2e7471ef", "comment": "Malware payload", "value": "33f08b9edd3de036f9151f2f28625927f30ea9a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348422, "uuid": "a7be9295-096d-4eae-ae11-2c5cb8478a1d", "comment": "Malware payload", "value": "b6c99fd833aac9c61b9c94c7359a6ecd1795406d261d4fcdc003ce9738cab781101e556eb1d808e6c769dbc4c81f1e7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348422, "uuid": "1d7b0f1c-116e-4ee9-944e-80cb40712f49", "value": "T180F2E9E3C62A9FF6D106B4B055F1CD780B26BD525B1B1EA4A1368BE0024FDC8F185776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348422, "uuid": "ddeea366-37c3-492d-b855-27d9624113a0", "value": "384:Yy2XECZX1X3vS/zgVQLFLgRgoI2XdQC292qjoplOHiwCTkwyTwNoCwRAH/jE4Xs8:Yy2nDIgQuSwX7OHiTkwysSDR4799", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348422, "uuid": "a9859dbb-dc89-4fd7-b024-3865c48a4273", "value": 36632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348422, "uuid": "aed13a49-7ee1-4d89-80c2-35955513950f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348422, "uuid": "5dcf7eb5-d800-4130-b888-f656b21b0f9a", "value": "main.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54fe94b1-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786373645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373645, "uuid": "f8cc9794-6295-41b0-82e4-885f1e9d8681", "comment": "Malware payload (PureLogsStealer)", "value": "cd7827aef25647ba17733b67290dba93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373645, "uuid": "a6013ae4-49b7-4597-a9e9-441edcaa40bc", "comment": "Malware payload (PureLogsStealer)", "value": "9025d2705a1ca25d0cd25490fb9a000c3495e12abfbf770d2313d729674cff26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373645, "uuid": "de20ca29-beea-4ce2-8291-2f4fa2bedb48", "comment": "Malware payload (PureLogsStealer)", "value": "7010cf2cd0d08c6c4f2788aa5b5254cbaf14d513", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373645, "uuid": "4d1ec866-699a-4c92-95f7-67e16f1f394f", "comment": "Malware payload (PureLogsStealer)", "value": "cbf4860bf0efb0fc79ad3ce5270442f0196253fc03a5e62b6c7478c9e7e41e6dd3973ac6a222db80e827739b27e7015a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373645, "uuid": "c03fbd5e-194a-4222-8e50-b001e4f2a985", "value": "T10405AF2B76A18F21C3455372C1C3490187EA96876AB7FB0B329513E61D463FEDE4B287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373645, "uuid": "71475c6c-2a41-4fd2-b3b7-d17f49677161", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373645, "uuid": "48e66ac1-a7eb-4d56-8db9-c5b996cb62d2", "value": "12288:7svA/ta+jaN53u3jv3xEcSO1pTtjOji2ShkU3Had:7aK/aeDwO1pTtoVU3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373645, "uuid": "b08288cf-49da-44cb-bc78-06e3bb6dcc11", "value": 827904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373645, "uuid": "4bc9d47a-a2e4-4b6a-acad-985513b79912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373645, "uuid": "e9958daf-16e2-4895-8b99-7722cae11648", "value": "9025d2705a1ca25d0cd25490fb9a000c3495e12abfbf770d2313d729674cff26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e48716-9491-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786348603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348603, "uuid": "87694812-b8ab-48e0-8b9f-3f430ee0305b", "comment": "Malware payload", "value": "7637e951465e47f0caf9904193e5b4a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348603, "uuid": "9d6a0ee9-9a9f-4847-b09a-1cddbbc57caf", "comment": "Malware payload", "value": "9041c8f9648733b0a17e72ab8954eb2157d6b58cfc88c0c4a097b1c035d98fb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348603, "uuid": "81b5f997-5205-4960-ae35-0befa041c896", "comment": "Malware payload", "value": "1c7786cabe81282aaaeec97d7f86928dc0a28232", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786348603, "uuid": "8fbab663-c7d6-4e08-b2ba-faa33e0ee9f3", "comment": "Malware payload", "value": "a818c4a9dd3928db3600674f85002443982b9989a2b6331e66920b4fb0ce8587f4965d474bd10d69d06000a817859459", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348603, "uuid": "220eb58f-3c6b-42d7-93a0-76fe11b7681d", "value": "T1FAC64A43E8A545E5C0EED175CA66D623BA713C895B3023D32B60F7282F77BD0A9B9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348603, "uuid": "df600117-c02e-493e-a645-b2a1ac1d925f", "value": "196608:bvQfVQ6eMqzbQk5ZqQEFgiJPWkzpNOiFCd:bvQfVQGkdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786348603, "uuid": "3081de22-a91c-4617-8dee-f6b1c22e1fa0", "value": 11874488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786348603, "uuid": "d3230585-7393-4cf1-89e1-b316ce498a1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786348603, "uuid": "e5351245-cc9d-4bca-94ea-ddca96bae63a", "value": "cnc_new_x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b32e24e-9494-11f1-bd95-42010a9c0009", "comment": "Malware payload (Havoc)", "timestamp": 1786349925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349925, "uuid": "d3299238-2ea4-4175-aa53-f35217630070", "comment": "Malware payload (Havoc)", "value": "33d103a950e97fb4c0f28d8cff985ba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349925, "uuid": "a4a658a2-1941-4878-ba1a-e26dab6f81de", "comment": "Malware payload (Havoc)", "value": "904bb06ad9ad3c8e4aa980b96cbecad85c14bd994af013d77121723c85a5e1a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349925, "uuid": "4704fa08-b094-4fc7-a103-c8ae85b97e64", "comment": "Malware payload (Havoc)", "value": "1441b32780ec0e76d09af693f62819c2d1ae8125", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349925, "uuid": "e28d3b98-81f6-4104-92d4-e8ee04f0ed9f", "comment": "Malware payload (Havoc)", "value": "5b23350c019d581023451de563f4511ee5f4917893d0d98e9489e87fc02b8f3d9abd2c1de0b1fb4d927d892d30819e2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349925, "uuid": "db956e63-3f8f-46e1-b878-570884ad159b", "value": "T123A3A603E2A720FEC4A9C1B447CF7232FAB3B45C21346A0E5710CB652F62AB1767D659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349925, "uuid": "19ff2039-6da7-4124-a05a-15cc08da7ec3", "value": "1536:mkJIalOYktfCM83vOpq9UVE/kGE5+Kb+LwoMSJZNx5FOItbl:tlITtfCM72UVE/kOXMSJZDPOItb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786349925, "uuid": "3c4dbdd2-af84-4992-bea7-0f37cd2ee379", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786349925, "uuid": "a7c811ad-dd47-4c39-8679-18cbb0787bdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349925, "uuid": "e5dd3799-ebac-4290-a190-608dbd7a28ba", "value": "33d103a950e97fb4c0f28d8cff985ba6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4a0b19-9484-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786343186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343186, "uuid": "a72bcea6-3fba-4225-a895-961411cd95fd", "comment": "Malware payload", "value": "46e169c562fe1630d68dcf7d5eab0a9a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343186, "uuid": "f1d0cc4c-d99e-4fb3-ba9d-17210d17c3f8", "comment": "Malware payload", "value": "90537caea3d5dd17e1dddab8fd2069dd1059861341a1d1f3691cfa35b05a5c3a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343186, "uuid": "6c24b5a8-cddb-4ffd-bccd-b7c7146da2d8", "comment": "Malware payload", "value": "1e15205ea976af188eebca4732e7cf90355b70c8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343186, "uuid": "0aaf285a-185b-4083-b60e-47bc0b355fce", "comment": "Malware payload", "value": "6cf4ebc0f7254858b3d876b036e5eea10b6cd4beb860eb573bbeafc1a68384de4424b3c5fe3ecda9be260dda78873591", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343186, "uuid": "c30abeaf-0188-41af-be16-842738693af1", "value": "T1D23145DF94152A351002CA8EB763314DF98E95FB295FEBE4DC490DD946483CCF2A2B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343186, "uuid": "084f1bdc-9102-48e7-985b-efee46530622", "value": "24:Jj/YdZZV3lbaHqVvFgOqNSuFaZlXQxohDLtF:mdZZV37IFaq+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786343186, "uuid": "48e768e1-e44d-4839-8b48-e58361cf29e4", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786343186, "uuid": "617908af-ce39-42f5-bbb2-6445500daae8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343186, "uuid": "c027af9b-ac29-43c8-ac92-8cc617fb66da", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbb7647-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368881, "uuid": "8744809b-751b-4661-b11f-410a6618f401", "comment": "Malware payload", "value": "b5f26924598c424b43d12297625a07c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368881, "uuid": "3bdca080-6e9f-422f-af44-457293352293", "comment": "Malware payload", "value": "90621d4c62352d4474dec776542bf290a07292bef9d5409b24ab0dc5b67d26a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368881, "uuid": "8356db5d-557e-43e1-8d44-1a82fa571548", "comment": "Malware payload", "value": "8b4649de88847122192b76864760f0ebe293b837", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368881, "uuid": "36a0125a-d36e-478f-9480-074241542c9a", "comment": "Malware payload", "value": "13156e9d123d1bde9aeb14a653d10fb6e74cc66c824421b41102738b2b3bed5e24e84af391504b11f79d8a99f3063e1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368881, "uuid": "f01e1561-8e19-4c4a-a5ae-6b3cefad0d10", "value": "T10D15F11923D85B54F87E97B89174054187F5F812E733E70E7EACA4ED1A62F818A22723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368881, "uuid": "ab8282ec-cf96-4c53-986b-b63c7a889c78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368881, "uuid": "a842ff61-ce17-4158-8ba8-887bf063ce52", "value": "12288:7GM7ebB5kODVKaZuCgHebdfSK6bCMGPOr+e4ggVqfxNagXMPIx8yVADaT6CE:iM7efksxDZsTIPOr+e4ggVqHXOIGqmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368881, "uuid": "27ab7ee0-7f1f-4ca5-8614-37ea5d100c26", "value": 937472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368881, "uuid": "ab809a78-a4ec-4752-9d49-6aab23014701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368881, "uuid": "ba00c7c2-ed39-47a7-91ca-5b419d8c999b", "value": "90621d4c62352d4474dec776542bf290a07292bef9d5409b24ab0dc5b67d26a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb11e1c8-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1786370487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370487, "uuid": "c99eb06f-f783-4b39-bf1f-d75c0d607cb6", "comment": "Malware payload (MassLogger)", "value": "dd827b4e97ab48b2160f7c74277acfec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370487, "uuid": "5eac4cdc-a89b-4ca9-9d4f-54afd416325b", "comment": "Malware payload (MassLogger)", "value": "9071f1cff857d0618511ce6aa6084c0e7e80c86ec17e8193a6b7eb990d350220", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370487, "uuid": "67d7a272-43ae-4851-b9c8-6121867b362f", "comment": "Malware payload (MassLogger)", "value": "13c327699e7a9d204f26419130c1904ef4a7addd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370487, "uuid": "22a1f536-fa6b-4da9-b626-9bc55cea8652", "comment": "Malware payload (MassLogger)", "value": "85446293b75e47d0b4a29095a754f99b53c28c3b17ab150cbc41c9c27c572a1d318e4e1459e694a599cec5f7338e63c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370487, "uuid": "76d08bd2-953d-4838-94d6-d8c879f9e2d9", "value": "T14F25E1AC3A10F49FC883C9318A94FD74A6606DAA9707C20394E75EEBBD1D55BDE140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370487, "uuid": "2c676da8-1f65-4f80-b382-9ed6ea1d9a70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370487, "uuid": "263cbb7b-0671-4603-a7d5-ae6e347d2c8c", "value": "12288:d1CYIwiWpk1H9kWBgPESUt9iiCHqR7fAq0WAuZy9n0mSI7FUiCVLWiKjw1fTthFp:dnpkd9kuL9Ua89Sm/wWi3tYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370487, "uuid": "c1c3831d-9141-48e2-9d38-ca401dafd6f0", "value": 982016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370487, "uuid": "ed0122c4-3ee6-41d6-a030-4c2f337e7017", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370487, "uuid": "14b4b41d-740d-42a5-a293-84bd6cef6d30", "value": "9071f1cff857d0618511ce6aa6084c0e7e80c86ec17e8193a6b7eb990d350220", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5564912e-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786374075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374075, "uuid": "3c63167e-dc4e-4491-ba05-b11b15610106", "comment": "Malware payload (AgentTesla)", "value": "c5dc6a44af7a7b465f7b356f03116fd3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374075, "uuid": "bbdeb717-71e5-4d57-b5b7-71e63db42817", "comment": "Malware payload (AgentTesla)", "value": "907dd5d4c793cf6774a8f6638574b35ba6e6c9b10db51434eb5f60e4cee237df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374075, "uuid": "ea27482b-c8df-4d09-91e1-2a258b046a19", "comment": "Malware payload (AgentTesla)", "value": "a76894554c1da14d5a4355a20bda3b4b1911dac6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374075, "uuid": "7347ff07-a8f7-4bf7-b10e-499696831d91", "comment": "Malware payload (AgentTesla)", "value": "a01f6eba8ab607b66cdb9f3a98e5197a69bdfbacbcffb5fe1adeec2e5c72e1b7be780f0a2ea7ddafffeb679a5d3a27eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374075, "uuid": "02e304ef-1f34-4f87-ac4a-64ad8984fe5e", "value": "T1D02502982B5AD613C49497B80A72E3B4173D2EDAE401E30B9FDDBDEB763AF454C04252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374075, "uuid": "8e23a07f-872f-4356-910b-7bd3ab2f0c3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374075, "uuid": "5c9ee99b-69a8-43d1-8f4c-476dbf0469de", "value": "24576:5eA9sfIew0L0FxUhA8eQrT0UHvZI+LfC:gUsf7CxUhXrVHvtrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374075, "uuid": "5a50a762-2478-4649-905e-9289db961714", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374075, "uuid": "3f4ae10c-1c30-4d87-9f07-1e1c86595f4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374075, "uuid": "0ddb38bd-b8e4-4019-b5e7-e1c77cb4bed7", "value": "907dd5d4c793cf6774a8f6638574b35ba6e6c9b10db51434eb5f60e4cee237df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03a8d7c-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786369073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369073, "uuid": "103a4495-ab0c-46e6-a50a-35d718b08802", "comment": "Malware payload (PhantomStealer)", "value": "174f39d11536941a70fa73cb755ab3d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369073, "uuid": "1d83df85-130f-45bb-ab32-abe58feec79c", "comment": "Malware payload (PhantomStealer)", "value": "909e69b91922647d3c73ec3ec2c0dfcd0fc4926633710ba2d5ff8a57e958108b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369073, "uuid": "0bb0e056-fde1-422f-8832-99068347a7fd", "comment": "Malware payload (PhantomStealer)", "value": "9f72107597df9104fdf80404a5afbb95fc021309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369073, "uuid": "9d4ca4c1-7ac2-46cd-8b85-0ea9a2df9e30", "comment": "Malware payload (PhantomStealer)", "value": "d5172dfbb5a68540fc1f2442aa665b14dbff2a98f8ae2a3868b344e3b7e6ce176cd2ef0b8c61e418565dcda8f9d41fa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369073, "uuid": "9c9462aa-eacd-4994-a08b-0632094804e3", "value": "T12175231413AAEC06D1E61B700E61D3B412B95D98B872C3135EFE6CEBB66A789BC417D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369073, "uuid": "397d70b0-60fc-4b08-b516-9c7736b1cf89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369073, "uuid": "d0288dd0-e8bd-4046-82c4-2a64b26ea648", "value": "49152:AZg5MR2s7z2lBtDQNsJiCxbCSUyQHcVe9m4YZ/He:Aa5vUz2BtDIsIC1EnHie9m4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369073, "uuid": "aa340185-d6cb-4b55-9cee-f7e904bcaa17", "value": 1609728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369073, "uuid": "555fb1b8-8e58-4893-bb62-2e7ce53ed261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369073, "uuid": "5f2d2063-d360-4f1b-a504-7f68433577c7", "value": "909e69b91922647d3c73ec3ec2c0dfcd0fc4926633710ba2d5ff8a57e958108b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b98ba46-9495-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786350490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350490, "uuid": "b5ec0929-205f-45c4-acc8-201dc464502e", "comment": "Malware payload (AgentTesla)", "value": "1b00808e8d58b136cd389361d01eb377", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350490, "uuid": "4c8c1956-3faf-492a-8984-3f14342bfe8d", "comment": "Malware payload (AgentTesla)", "value": "90b2ceb05b34ed6012d20b547cec83a2dacbe56659eb4479150f30015172c3c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350490, "uuid": "03429808-72d0-4812-b15c-267bb34e8f08", "comment": "Malware payload (AgentTesla)", "value": "3692fc83c64796ce846099f9dc651a9b2140c10e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786350490, "uuid": "26d49c3f-72ac-4d06-8be2-c53bfcf2246f", "comment": "Malware payload (AgentTesla)", "value": "b6151fb201c22a57f675c03528fad1b53823a5736f85d7832e7e588c2242ae5ec5bd98428ca54de59a2f5c4499484bf9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350490, "uuid": "5c8baf14-70f1-4570-bf7a-1a2e46c1f444", "value": "T1BF35AD983214F49ECC57C972C964DEF4A7507C6AD30BE20390D73EABB93C95B9E141A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350490, "uuid": "bacc051b-6815-40ab-88d8-149143bed04f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350490, "uuid": "c48fda58-519b-462e-89e7-182af51b91be", "value": "24576:5RJ3smP3NRVXwZko1VLj7oshr3bdaqrX5Sk6zB97aQXYAn2:5r3P3NRVgpF0stbdTczH7aQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786350490, "uuid": "f517bde6-1aec-4e90-95d5-cec26bab0473", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786350490, "uuid": "ee1a7a91-a270-4c5a-8564-3d5af3918345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786350490, "uuid": "e8cf217f-2c6f-438a-8202-8eef8ff2e9c2", "value": "T. HALK BANKASI.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7e02da-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786368850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368850, "uuid": "e192d706-0728-4481-b61d-59c37132e29f", "comment": "Malware payload", "value": "7ba0e027b00b7147e9b9cb84919fc89c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368850, "uuid": "8efb0e0d-7db7-498c-8864-8ddfe3286759", "comment": "Malware payload", "value": "90dc1e1670dce4bdb081ba2ce779493b761787881c9d6c84f926d054885e250e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368850, "uuid": "1dbbb794-b0c0-4e3f-9765-5378dd53ce0f", "comment": "Malware payload", "value": "9840d08d7da53700ffa4917241660e2fef702416", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368850, "uuid": "9b77cee3-2ac8-4211-8475-8542fbffc0d6", "comment": "Malware payload", "value": "86d9fcc9d9f1b44da32341d67810988b3bf92f73fac9adde644321ec1bb57ff7b2ddb3621a321fc10192d3e5ead81d92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368850, "uuid": "76ca42a2-5a0a-40b3-a98e-30d9b7d57b95", "value": "T1CF832935F1D950D2CABF72B874368BA6DB3493D556244208DA5CB8B93EFD3018970A8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368850, "uuid": "f5c69204-de9a-4fec-a71d-0f3f47362d57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368850, "uuid": "d2d6a118-0366-4924-89c1-ee1c65b58aac", "value": "1536:jcb/4ay7OKnmO9cEURBNwC9+S7XVTy1PJe5a1DIKxJVzpArePK6CtTvJsANVR5:jcbXy7OKnmO5UrNbUSrcyjR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368850, "uuid": "35b9f547-fdf4-42a7-8856-2133a2691798", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368850, "uuid": "9c939ac2-c845-44c4-9d08-f84c3b7944cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368850, "uuid": "09b5e719-0d56-4338-8454-bb52bdfe980b", "value": "90dc1e1670dce4bdb081ba2ce779493b761787881c9d6c84f926d054885e250e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05a4c03-94c3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786370442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370442, "uuid": "29fab77b-80de-4671-a935-17661e65b695", "comment": "Malware payload", "value": "2ee1d7416a1d1485b5818dd9258c8a3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370442, "uuid": "a3813d6b-ac95-403d-b283-1184af595680", "comment": "Malware payload", "value": "91811f3bac27030772f4e79bfa790c9e09c183ab6ad08c71cbcc94204105b9e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370442, "uuid": "98bdd3e7-66ae-4dba-8864-1140e012184c", "comment": "Malware payload", "value": "59635478d254abf3328e07dab1bd509aef9418ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370442, "uuid": "1226d8cf-05c2-4a9e-83f3-76fdd5e08ff1", "comment": "Malware payload", "value": "c8edb44d27e199ed7f8542a807aa281b07ac1174b040be222c52e2c03165040d0d01265253ad45b00a58c851cda1f6bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370442, "uuid": "47db5eb0-bf6e-4e19-b1a9-5b19773a6d00", "value": "T16B25F1161D873B88DBBE6FB8C163099437F0D8078292E72B7FDE11F49E92B84C915066", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370442, "uuid": "b083281d-271c-4370-8698-74850fd3bb53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370442, "uuid": "9389b62f-77d7-4c86-ac12-e5e966c2c478", "value": "12288:6QXwzkWh5YX8kBzdG7oe9mxHewPrQjekCmVALeuFWrcaWJlkQvddbY3kpBNa6:6g450jhwH7krKrVALNUSjkQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370442, "uuid": "df0c9cbe-b15b-428c-990c-251121749498", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370442, "uuid": "366e83e8-9999-47a8-8647-5548344d3840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370442, "uuid": "01b8da1d-85a0-479f-8fd3-a322dcebfd44", "value": "91811f3bac27030772f4e79bfa790c9e09c183ab6ad08c71cbcc94204105b9e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575cb6ab-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (RevStealer)", "timestamp": 1786372790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372790, "uuid": "dabb2d9a-7229-4c23-8f0f-ee7c0c52e112", "comment": "Malware payload (RevStealer)", "value": "69d45c7257a02f26d168b48c14612e9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372790, "uuid": "7d70edd5-1fc0-4ecb-8732-92e0562f5add", "comment": "Malware payload (RevStealer)", "value": "91d44004bd98637f82c46fa2924f2f80c1574c9965bdbe618af5d5f4a2cf3424", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372790, "uuid": "2827f25a-f511-4133-b6bc-3e77f860228a", "comment": "Malware payload (RevStealer)", "value": "ac59012f87362509ed86073237f17ff4709b81ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372790, "uuid": "402556ac-bc91-458d-87f9-b0ecfa32b50c", "comment": "Malware payload (RevStealer)", "value": "c0dd8cd0a6cccb9868d300f353711fa4abcde2066c936d5c615f147887c9301f1b23bc3cb38642047d40da9bf3e66c5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevStealer", "colour": "#E1B811", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372790, "uuid": "0f573854-3736-4d36-a470-727dc6ad0526", "value": "T1C3660827629BC178C63D973EC192CA549BF771788F3292E3F3C683559B424D56E3A220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372790, "uuid": "fd71990e-7dea-4ba6-bf25-02750647bd7f", "value": "84702c834326954655d1118866ba2cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372790, "uuid": "188cf2b9-0741-4c6c-8812-c50dcc2047d2", "value": "49152:0HKQyy9sC131rhTEzs/0vMSkYxkCbX+EzzLyCnwn9/:0HhuvzzDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372790, "uuid": "aaa9a68e-2c47-47bc-a0f6-f2f35211cb0a", "value": 6846904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372790, "uuid": "6870573c-20c2-46c0-98c3-d53d6f00189c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372790, "uuid": "24d77e70-1216-4366-b94c-e5d746aab77f", "value": "91d44004bd98637f82c46fa2924f2f80c1574c9965bdbe618af5d5f4a2cf3424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9733c652-9502-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786397378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397378, "uuid": "3fe16aee-e119-4d18-8e22-4c08f8892468", "comment": "Malware payload", "value": "1d6f5ab5460155f38f4d0c7c2f6fd8f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397378, "uuid": "0bef6e47-5bad-49f0-9d97-7cff4ef2c304", "comment": "Malware payload", "value": "91e134147bc063254df25f675bdec05259eca85e7a9b80b0ce9b1973ccb26a59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397378, "uuid": "48c736ba-cedd-4e37-ae11-7c09a7aed1f9", "comment": "Malware payload", "value": "bf4261960cf073a4a199b224297887dc0dd9a776", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786397378, "uuid": "8718b7bf-5d21-4ebf-a9ea-9372887918e5", "comment": "Malware payload", "value": "dc0888d281097a0a264347ca8785a9db663d31470845cc718bdda6e342b779a2311b89920c24ce88234c6caf5b016721", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397378, "uuid": "904eb1b0-1610-4758-ba9a-7989ba98caae", "value": "T106D30A06ED856EF7C01ECD70453DC24A15D65CAA92E9A22F71FCC98CBBBD3054AD7888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397378, "uuid": "dd2da6bf-8b5a-473a-afe5-9e37c27a45c3", "value": "1536:Ms0xOkk2k2TV9aKMw8HVmB8/JYwaBi8g4FnJGEavcF2kNm9bJlqnA9OUXLIEr:kD5FoS8HVm3wa5yCZNmdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786397378, "uuid": "07ba6416-538c-4cc0-9450-bb6fcb3110b7", "value": 140068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786397378, "uuid": "ebe8a6a6-f0a9-4874-89b1-6a94f7899159", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786397378, "uuid": "4b33f111-77f1-431c-a6d3-95af03ed7009", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d761670e-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1786372575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372575, "uuid": "c72e401b-322e-4b85-9035-e7cffe95e6f1", "comment": "Malware payload (PhantomStealer)", "value": "0ce7712c14ca025f5295adf5260178b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372575, "uuid": "dc1c8903-494a-4ca4-894b-235be2e76917", "comment": "Malware payload (PhantomStealer)", "value": "92495a3e4c1e965e074186655ed5098e7020e44e0f1ebebc7442349c619ae5cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372575, "uuid": "c2bf5b20-bbe2-4b10-ad16-475371c2e211", "comment": "Malware payload (PhantomStealer)", "value": "19ecd24796e4321a52d200c2a1e0d01b7ce662e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372575, "uuid": "5c169105-b95e-46f7-8605-1254e63789a7", "comment": "Malware payload (PhantomStealer)", "value": "3390882d516533af288e3f70bffe37e9047167265c4464675741d7ff0c3bbf485ef0f0bdd942384eed93d844a328d432", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372575, "uuid": "1d05dc66-80b3-4c00-99dc-29595b077ba4", "value": "T1A1E5BE55A3D865E9D426DA349714E232D2B27D234B76E08F0A8AF3061F779924F3FB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372575, "uuid": "78a73a95-af08-40bc-a055-1305005822e2", "value": "592f2a4e38c27b54ff57db9c30b12a37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372575, "uuid": "a1d3169a-737f-428d-90cc-2dc1b26459be", "value": "98304:7Z7iPsq1CjmWW1UaFNPToLOIqBpqsnHygzD57b+0nSFq8GTntboo/0xrgN3:7Z7o1CjmWW1UaFNPTPhqwygp7i0npdt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372575, "uuid": "135ecba6-7c9d-41c7-bd2b-03cd3cd1153e", "value": 3273728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372575, "uuid": "01f6763c-4ba8-44ed-a5b3-537870b58d2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372575, "uuid": "40ad5452-99e3-4600-a1bd-98dfcfaf3e01", "value": "92495a3e4c1e965e074186655ed5098e7020e44e0f1ebebc7442349c619ae5cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540d1ed5-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368489, "uuid": "7ea0dae2-472e-4bc2-8757-9627bc206241", "comment": "Malware payload (Formbook)", "value": "03f4819d233bd7f69a108c4a2a9f82ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368489, "uuid": "ef84f1f2-932c-423a-bae1-cb0f680f4753", "comment": "Malware payload (Formbook)", "value": "9283fe438700c0487565377258d4e4c22fc6b268005f5140000a2dd464cf4559", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368489, "uuid": "d8b8d02d-25ec-44c8-b6da-ab94f4568a56", "comment": "Malware payload (Formbook)", "value": "c2636e197088aded0b178dcb7ffbbb77882ac067", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368489, "uuid": "01043053-49bf-4474-bde3-8b02a942845a", "comment": "Malware payload (Formbook)", "value": "787c2bac3ada60354c2d2002774a7809922f47c1fd8d555ab869c19c1bbe5807ceb56b0ec30d61f9d7395b0e372f40e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368489, "uuid": "881a3ccc-27c5-496f-837b-efe5de724976", "value": "T19D35F1C4372AE709CD540A35D979EEF452AA1D68B041BAE39AEC7F5B75BE2006C0DF01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368489, "uuid": "c10f58b6-60e8-464d-b14e-3990b147654a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368489, "uuid": "39dcc563-b150-4f36-80a4-3c48e44b7736", "value": "24576:A1BUFLa2JTh2YdWK6VfRhUOzFHVJ5auPdDlfkJuKh75Z:A4da2JV2XK6VztPtlAfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368489, "uuid": "c80a6732-2298-4bca-ba02-8cf792f94e26", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368489, "uuid": "84a78c52-9afa-4a87-9562-182eb08a97ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368489, "uuid": "edad96c6-1586-42a2-9552-6fa0c32743d1", "value": "9283fe438700c0487565377258d4e4c22fc6b268005f5140000a2dd464cf4559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9610373a-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786371177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371177, "uuid": "1e862820-f800-44c9-849a-43b687281b47", "comment": "Malware payload (Formbook)", "value": "3e62c7c4fdd00831857b665202eba41c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371177, "uuid": "acc33c8f-7a6d-492a-ab0a-9efab19af3cb", "comment": "Malware payload (Formbook)", "value": "92d433c1eb67b2d701fcf561b80e201706e0c6eb3ae7d7ca06ee3d268cb91908", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371177, "uuid": "09fcdd78-dab0-495f-be11-b4bbc269f48f", "comment": "Malware payload (Formbook)", "value": "b9b6c4df23274c4074c2bb4078f525fcc14773cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371177, "uuid": "38fc6ec7-e9ec-4f72-92e3-7b1e1547c4a1", "comment": "Malware payload (Formbook)", "value": "14992d5caf458266c3051aef63992214e514ab9cc0b6a6d40513f98197470f2bdc4ff2f108fddf6b719a71771558b7ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371177, "uuid": "f7a7efca-d708-4019-9c6b-bd58510230fe", "value": "T152451288334ADC02D4928FB04D70E7B405795E81A815E7579FFBBCABB97E3876C51282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371177, "uuid": "762bba6e-7b97-4dca-9fd6-17ab35a8c3d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371177, "uuid": "2955c9e2-b8bc-4b49-8697-3557e763d8cb", "value": "24576:8R6pFF/JhJELdARNPGFL2Q9/iVRPw8qnYdfahM/eZ:kifJoARRGV2D63y/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371177, "uuid": "2fdda608-589f-4f09-923c-8a9f72aa6685", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371177, "uuid": "a2bfda02-ca69-4126-8927-1ced2ca47685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371177, "uuid": "b7207e5f-1377-42fa-9c1a-a18455bb338e", "value": "92d433c1eb67b2d701fcf561b80e201706e0c6eb3ae7d7ca06ee3d268cb91908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eef7a79-94c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786370977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370977, "uuid": "e0ae96f8-283e-43b1-92ac-57adb914dc49", "comment": "Malware payload (Formbook)", "value": "e8a079354293e8e14560d13aec797f9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370977, "uuid": "4f6175d4-8d9e-4b9e-b185-d63621ac04e6", "comment": "Malware payload (Formbook)", "value": "9359aaa225ca8ccbe7b5cc67145007036d171d2a119bd34689bdf3aa01f20970", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370977, "uuid": "a8ca1df2-e0b7-4e6d-ba6e-b36c84b470aa", "comment": "Malware payload (Formbook)", "value": "cb3f0971c8a4eb867e8ba2f4e246032bb2356c4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370977, "uuid": "cb8618a1-dbd3-44bf-8174-2dd620a7e7fa", "comment": "Malware payload (Formbook)", "value": "05eb02cc28c4a364be4c1966465f5f2b059bd65e112b9f4ee25f0074b989a56492b047838bf71fb49e2724d11d8ffd17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370977, "uuid": "077661d5-32f0-45d4-b73d-6a186b794d7a", "value": "T1B0350219231ACD02C6935FB15E70E37905B85D98B811E2B39EF6BDD7F87E3866C12281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370977, "uuid": "ef24a2ff-6196-4359-bcbd-81ebb8c087c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370977, "uuid": "c8bd5772-83d6-4a29-b0ba-32b048edc09a", "value": "24576:lWejR6pFsRoSsD+WAnN8aXKDRfsXwYcJ/7wjc9LM8h5Yjcdqb6:lTtimRoSu+JzaNsXPcV7bLMOd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370977, "uuid": "e11649a8-4541-4156-bb06-b253de8f6aaf", "value": 1136640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370977, "uuid": "fbcec7d2-ad37-4587-946f-7c520bee9c80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370977, "uuid": "17fb7a8c-09ba-45b5-9c38-2faa9e7f1bfa", "value": "9359aaa225ca8ccbe7b5cc67145007036d171d2a119bd34689bdf3aa01f20970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08456ab-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372053, "uuid": "49b73232-9d51-40c5-931d-c7c5edc1acaf", "comment": "Malware payload (Formbook)", "value": "7acea89cd620fd29752239b1bd95e4c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372053, "uuid": "f6c2516b-a9c7-43f7-8a59-7ae5d579caf8", "comment": "Malware payload (Formbook)", "value": "949274b000a50d3c872f23806de4de694d8901129fe1393884c4adf35796600f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372053, "uuid": "4e9e9d3f-0316-463b-b9dc-6cd62080022a", "comment": "Malware payload (Formbook)", "value": "0b986719ebbfbc4b6e60b96a516ddd364e5367ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372053, "uuid": "ec6229f6-3bd2-4375-be12-5d5cdd388eac", "comment": "Malware payload (Formbook)", "value": "c4cef92e834f149ee029e3a0ef3ebd6ca7eebb3db50f497575421db9cfcbebab5fcb70b241701468114f590b49f7bbaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372053, "uuid": "e492a7ec-1775-4269-8597-665628bde1d5", "value": "T1ECB5D004BE4A1246DC02D4B7F8DF91A32752AF63C6F8A45FFA083F5E5451848D60B9FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372053, "uuid": "1ea8f5dc-9887-4ae9-8ef8-1d176fad42c2", "value": "b6363985b589e2443f1a337d0f18c65c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372053, "uuid": "f74ff811-7ebb-46d2-9492-6736e25ffcbd", "value": "24576:NHtIGsGfxQKvaYBXupd7ulZlbkGn07wwA:jIGpZZiYcd7uPWGnnwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372053, "uuid": "9fcfb775-313a-4ed8-ae95-ca6ba868be4c", "value": 2318848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372053, "uuid": "690345e7-00ba-4239-baad-b33dd1b895a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372053, "uuid": "8b82f91e-b3e3-435a-a58f-a27e59752a10", "value": "949274b000a50d3c872f23806de4de694d8901129fe1393884c4adf35796600f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c527f078-94c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786372115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372115, "uuid": "b869a62f-2fc6-4950-b15f-201fc705bb5c", "comment": "Malware payload (Formbook)", "value": "1d2a39143134d0e5ab88fa9cb2d5be82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372115, "uuid": "ab4fad9c-b92d-4fca-ad7d-b00bae38dc94", "comment": "Malware payload (Formbook)", "value": "94ae5d7c44f8072acdd2175088707215de59d62b03e9a3393312657788b2fdf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372115, "uuid": "fac52f47-69a7-4f4c-b690-9340c3d1cdc0", "comment": "Malware payload (Formbook)", "value": "13e591515dc23a52a018deef8884050a10363e5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372115, "uuid": "bb7ffcbd-53c2-4c85-8730-5189d29206b1", "comment": "Malware payload (Formbook)", "value": "8c42ce6a24e001b80e7d471b0af76eca36a04dcfd0de625fe3cdeb3fa5d5f8e585e84bc7f2956c1654bbda865b1c3382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372115, "uuid": "553d6a39-70d4-4e5a-a502-c10ad47d26b6", "value": "T1F035F19C7660B69FC857C9328A68DC70AA207CAA9307D30391D75DEFB91C997CE141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372115, "uuid": "41153e6e-3fa8-4a14-9b30-862b37596e85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372115, "uuid": "4d6d436c-6f5f-40d2-ad48-5b8610105743", "value": "24576:urPj/Og3gaXECXvAyNMp+Zl9e5RSoI505HYMv+9VFm3:uPPQaDpNMYZjCQc5HX+9VFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372115, "uuid": "d1801366-208e-4336-b8b1-1ac7cf8a7294", "value": 1112064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372115, "uuid": "6c87988d-fbf6-467d-824c-6c6da2889b5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372115, "uuid": "12a27481-d385-4d0c-a34d-a065bc506e63", "value": "94ae5d7c44f8072acdd2175088707215de59d62b03e9a3393312657788b2fdf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd77ffb7-948d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347191, "uuid": "9425b7c0-caf3-4f2b-8c83-8fd80f6789be", "comment": "Malware payload (Mirai)", "value": "37ca7c8d14be840ab6d88c07c79cf445", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347191, "uuid": "09b37365-33ed-44ce-aa53-9d81f582883c", "comment": "Malware payload (Mirai)", "value": "94ca187d2680779089c15de5cb075c8368a033914ed3d960b2cd7b82e7553fbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347191, "uuid": "91b0afe0-6c0f-4e99-a7a8-1c4bc1755679", "comment": "Malware payload (Mirai)", "value": "a0461ee395007f457a6a8996f5a96d8fd7029075", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347191, "uuid": "339f4370-d54c-40f2-bc39-81343d07cc4a", "comment": "Malware payload (Mirai)", "value": "4fa34529b05ad6991dd92daedef3e4cdb64c1f781f1d8e59fd4beefce1c49b18f326e552357d24e57705efbf9400542a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347191, "uuid": "9f80e866-bcf8-4a47-8511-08d5b0be91cd", "value": "T1A8C4BE67F5261E43C8E3953E2567C2B45327E60A27919306A70EF5B83DE63398F293C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347191, "uuid": "55fcceb7-4384-4f6d-bb36-cddf14d95cc3", "value": "12288:inzxoZ+93Gdx32umLhhwMwtHnb6arR6zJ08pgWijUhRCdTf6/ozxehED9zB:GweqxG+MaHb6pi1f6/oz4hED9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347191, "uuid": "7c7a432d-a7ef-4eb5-bdbf-b35d78d830dc", "value": 583224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347191, "uuid": "152719e7-f990-4b4b-b2e9-ac3d49d0e976", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347191, "uuid": "03f6a4cb-221d-4900-9739-e45cab3b6ac6", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd521af-948d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347188, "uuid": "362018b6-a5a3-4e7e-9aeb-bb769fc71501", "comment": "Malware payload (Mirai)", "value": "b67831c7661eb598c8100012585e409b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347188, "uuid": "a022fa76-c0b0-47d2-9979-9eff8098d579", "comment": "Malware payload (Mirai)", "value": "954dd815b49eafe68cf6f493ca1cd9a409a6f1af48c25084c844a24f06ffa38a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347188, "uuid": "8eb96f7f-353e-4c45-8cf8-e9d0d5333689", "comment": "Malware payload (Mirai)", "value": "c1748442e3573089b7c8638e60996636084f75ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347188, "uuid": "518f2432-ff1c-4680-a1dd-db25b31a3a44", "comment": "Malware payload (Mirai)", "value": "f3e3f5bea6cd79976b0e4ebe7ceff79cc88fc144a3ee86695d25c3fd91aceadd2ae9b7cd6b161d1ce4c3298481c5caa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347188, "uuid": "31d285ac-c091-4d0f-ac8f-c01ead8ce240", "value": "T13D83081ABD41AF15D4C526BAFF1E524A33531BB8E3EE7202DE146B2527CA91F4F3A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347188, "uuid": "4887d587-1db8-44fc-a24f-239edfcba86d", "value": "1536:fqnOlox/XLmikBwoGwfC9itxxsmrYSsEk2HVVo0rbdlhti51VGIn:floRiVG9YsmrbsEk2HVVT5K1VGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347188, "uuid": "508b73c6-2030-40b3-8cda-24501d248d86", "value": 88260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347188, "uuid": "41e1b284-cd4f-44b9-a586-57b5b100bd46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347188, "uuid": "8cf37d96-679c-4c28-8ee5-4bb21ddf8b1e", "value": "1htR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203fdf0e-947d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786340055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340055, "uuid": "85fc9b48-63f1-4313-a0a3-5dff6e5bd36e", "comment": "Malware payload (Mirai)", "value": "03c0a94926b1e3a5eb4ef01e2e3e3c79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340055, "uuid": "5f67149d-8b09-41ad-9d68-967f829f2847", "comment": "Malware payload (Mirai)", "value": "9615213e9f9922391e28f1cb9db166094c75608fab45cd4cd15cc767a2d69646", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340055, "uuid": "04c21104-f2d6-40ff-bed3-6a9416abe599", "comment": "Malware payload (Mirai)", "value": "33c683d4dd3b34a06a4f1984e4cca11f52a7fe7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786340055, "uuid": "3bd55bd6-1251-4cab-b0f9-0f7914fe1201", "comment": "Malware payload (Mirai)", "value": "15035117f41354c4414893f0b52e07c64a5d5230121de86c6a21f79876e4e0dc05513652236e2a71c7dde0e52aaf6c8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340055, "uuid": "2542ee89-3d1d-4051-9b44-5095d2de3631", "value": "T16684FC8CB5F2E2CAD1D4E6B5B319784937530736B1D77146A50EEA3323EF19809BDA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340055, "uuid": "34d65cbd-de34-4549-873b-ff81d06c0874", "value": "6144:qLa9ja9Pa9aaKdGrhWK3eDRs75844u5TuTo/SkCpiA0eh:qLa9ja9Pa9aacG2DC7f4kO4Cp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786340055, "uuid": "dbe74af6-e895-4b04-b668-b4b4de7c070e", "value": 376004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786340055, "uuid": "e704e83c-523c-4538-b6c5-c1c0e7c1a9f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786340055, "uuid": "77cbb903-9ca7-499a-8547-f8e88698bfd7", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0ee63e-94c8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786372371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372371, "uuid": "f12d07a4-b00e-4e0a-8025-1dea8b83a47b", "comment": "Malware payload (Mirai)", "value": "0227fde0bb0c05809f84e34bb6c7b8e9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372371, "uuid": "bbadfc05-37d3-4b77-86ff-acf9c3b37279", "comment": "Malware payload (Mirai)", "value": "963d986f444f3a811ab89a50dd7f642621d709fc5d374f6d34445ee730c5924a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372371, "uuid": "f90dac1b-fa7b-4b93-918d-49cd9b977244", "comment": "Malware payload (Mirai)", "value": "cee3a366b6c4edfaada8e8015fb6d9c871281457", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372371, "uuid": "62c7f876-f4fc-4fb9-bd26-c19fc0858ac6", "comment": "Malware payload (Mirai)", "value": "8e9a73fda799ba02eff488ba8c4f5f28b95d412500f79541aab5c880304c46b2c5a96cedb369101c50bd2775c0d29ebb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372371, "uuid": "ea96c758-dcdb-482f-987e-c8ca8b28ad4d", "value": "T12DA1E48A3070973CA46EDE6C3DE54A58688985E237B13F395EB008737C89970B749F5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372371, "uuid": "ee12feb0-deaf-41ff-9a5c-d389004afd18", "value": "96:jl98rvBibLxD6xIAJ3foxP2j1y66xn/4OQTd/SnB0L6Tm/tiVXZIpF94hx8fbctt:jl98rvBibLxD6qAJ3foxP2j1y66xn/4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372371, "uuid": "79f6fadb-b370-4762-a92e-0546902a10fa", "value": 4725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372371, "uuid": "9f160861-aa78-44aa-8061-7196d23615cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372371, "uuid": "0e262fbd-bc65-4281-85bd-289de53320ea", "value": "tvt.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a27ceb-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786373882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373882, "uuid": "e58c3869-14c0-4020-bcdc-ff298c5a1475", "comment": "Malware payload (AsyncRAT)", "value": "feca54b5cb43f2855ddc27bd8ec8a198", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373882, "uuid": "f1361944-592c-4658-b505-c2edfdeee1a1", "comment": "Malware payload (AsyncRAT)", "value": "9666e6c9474059b23b4c55a894f2a5768b0a37fee47523c281e07b7df4f2b1c6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373882, "uuid": "8a40b8c6-a98d-4914-bd07-07b1c1c9854b", "comment": "Malware payload (AsyncRAT)", "value": "32608a9b7676e3678f219a9ef2930512c7b275c3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373882, "uuid": "c582bc38-eb32-41b5-8f6d-fa6f37817491", "comment": "Malware payload (AsyncRAT)", "value": "cb9c7eeb323cdc12890295d902ba1a663407a679bb40561ffa6534196647da8006e3e96a670274b69d251cb6485de85e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373882, "uuid": "0cb9f6db-843d-47be-9a48-824db3ed8678", "value": "T133F412683BA2CF02E5765BF91273E23147B92CDA5A30C10A5FDA6DDF7553B044821763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373882, "uuid": "20aaca72-a991-4df0-a70d-5b6ce994161c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373882, "uuid": "6db3ae96-01df-4fe0-b89f-38eaff54107c", "value": "12288:m03CpLaqpsXRhpAzfA2eC2EKoj/UwTyM2x3XQNrvOLMt+ZNZxfKHOccj:3Sp/+GzfmCIbweMWnyTOLYIZ5YOccj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373882, "uuid": "009b49bc-aab9-4c7c-a357-9e667dc4fa5e", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373882, "uuid": "a4e2941d-b375-457f-9dbd-4c9f7728dd88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373882, "uuid": "284f687d-e082-4ca7-9431-57e126d2e0f4", "value": "9666e6c9474059b23b4c55a894f2a5768b0a37fee47523c281e07b7df4f2b1c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d9a5e6-94bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786368708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368708, "uuid": "c9a11381-c58a-4ca1-9555-caeba19e2fe2", "comment": "Malware payload (Formbook)", "value": "42f6de0963bae9859d133f52466bbd2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368708, "uuid": "40967786-58c5-4c99-b6ca-bec920f19df3", "comment": "Malware payload (Formbook)", "value": "96840e2fa8927c1f709d170e0eef870ce4ccdf67b312a1954049583013a0e975", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368708, "uuid": "c7957af4-dc3b-499c-a8d2-e1612f7edfa5", "comment": "Malware payload (Formbook)", "value": "04aa2084f27f0ffa136b4342ba861748650d5a66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786368708, "uuid": "6323a941-de2c-4c61-a0c1-8bd65dc25a2e", "comment": "Malware payload (Formbook)", "value": "e246427909e23ce8a16c1a006fd00b82244e6781cb6e3d8a9de84b586b8d18086ed9273131fe71cf82f1821680eecd73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368708, "uuid": "3765b257-4b0b-487e-bd73-a8fa27b2b5f3", "value": "T1F92512B06689D921D1A6437085A2D3F900B6BD0DE020C76BCBFCBCDB3B72B86745575A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368708, "uuid": "1b25c1f0-fae6-4afe-8b02-2ce8b2774dbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368708, "uuid": "33d62870-f468-49b4-bea5-36bf32cae1fd", "value": "24576:By5Q4ZE5P+1Lj3eYwRoeTwz36MpW/YTIAa7C:BqQ4Euf3eYw2kwz3XWQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786368708, "uuid": "a3900aaa-b064-4c00-b58e-383e2cde61a9", "value": 1015296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786368708, "uuid": "4b246ab1-9e7d-4f80-a69f-f9a95b6ab378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786368708, "uuid": "732e91a9-629f-489a-9355-d3129dcd239d", "value": "96840e2fa8927c1f709d170e0eef870ce4ccdf67b312a1954049583013a0e975", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465b0277-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786374049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374049, "uuid": "8e290d50-5f5c-4955-9836-baf0023b9836", "comment": "Malware payload (AgentTesla)", "value": "3d1bb58c18b5476fd0174053e1d01c54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374049, "uuid": "4c5aae4e-75fa-435f-80e8-1819c4df5ee3", "comment": "Malware payload (AgentTesla)", "value": "96bc0795b6b630c8079d53feb88a0331e89b27747fcf7ed464c672b36d8e1354", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374049, "uuid": "7fa340c5-32b0-4163-b5c0-479cfe9c9b3e", "comment": "Malware payload (AgentTesla)", "value": "d74d3433af254e0432d1f8ef4e3012a67ae25ade", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374049, "uuid": "33705f2f-10f0-469d-9583-e805ddb56277", "comment": "Malware payload (AgentTesla)", "value": "acb89e8de850d0cdd86368dcf4d15f8eccf3e1b4c0ce4806b662924ade5107e768390a2c58c3d446797d2e5439823d37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374049, "uuid": "c429755f-f4e3-4f78-baf6-b5521f0a3e10", "value": "T1162512086A06EA02C9A4C3B84A72F2B9277D5DEDE410E2076FDDADE7B575F244C44393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374049, "uuid": "aebbcd9c-3ae1-4694-931a-3997041826f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374049, "uuid": "d886c7d5-8e4e-434c-b817-3a535aa23b11", "value": "24576:QpILJFdAIWJdBlhIM1lVmIssh/rIaVeA9s:QeLJAIWJd5b1lmsNrIaMUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374049, "uuid": "24f1c78f-3cca-4692-b719-007df6bac86c", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374049, "uuid": "6f0546ca-b179-485d-808a-c0f92372dd57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374049, "uuid": "6bbb7566-6333-4595-8100-f1ae14ba8b8e", "value": "96bc0795b6b630c8079d53feb88a0331e89b27747fcf7ed464c672b36d8e1354", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f363af43-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1786373910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373910, "uuid": "dfcc8591-aa46-40c8-8ca7-a74f2254cbcc", "comment": "Malware payload (XWorm)", "value": "e901ead227e8cdd8d274dad6a29e3f0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373910, "uuid": "17cb25ff-8590-402a-bc6d-0bfcc474954e", "comment": "Malware payload (XWorm)", "value": "9719021478f61f07d57a297ed9638d63afdeeccf3cd4771f429f8af8c353c634", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373910, "uuid": "7e1debd2-e6c6-470b-ad36-9f61a64a873e", "comment": "Malware payload (XWorm)", "value": "901300032754f5e09e107f1254d58a6c52d50df8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373910, "uuid": "55b38d3d-68a2-4a95-bd64-ad963f46ab22", "comment": "Malware payload (XWorm)", "value": "55d53edcd7fa248da8374dc58de072ba37130f46ffe009b358528e97d8e4d8ee9f877730466e56bb5a101662b0200682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373910, "uuid": "8f748c6d-3e9a-46c3-a273-2ce87b1bfe10", "value": "T14F345F9EAE0106F7D70CF83580F3332D537ECE7A3A965F5DE89E3EA566718884949810", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373910, "uuid": "65d4188a-022a-4a04-a0e7-e0abecd2348a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373910, "uuid": "84d3c21c-bfd8-4148-8cab-86b252967d64", "value": "3072:5LhjyuO/ooM3joJizpbOw7M/EtYmS4g+Ehfr:Nh+vLijowdbPW4g+Ehf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373910, "uuid": "81def0b0-e73b-45cf-8f4f-3ea1fc50f378", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373910, "uuid": "a49869b0-e263-400f-ae52-81f019ab43a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373910, "uuid": "ca27196b-2ca6-4918-b0e7-679cbebb57d8", "value": "9719021478f61f07d57a297ed9638d63afdeeccf3cd4771f429f8af8c353c634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b851ee-94c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786369004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369004, "uuid": "16d1b546-1cd9-4a97-a756-0b1a81d16a07", "comment": "Malware payload (Formbook)", "value": "b2abf4c875410b084de90b19506088a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369004, "uuid": "1a8b6aa1-8b84-4dac-841a-452fcc55c443", "comment": "Malware payload (Formbook)", "value": "976529425f33163b3ce6c6edefb343aa3751472a2232d7d2cc72dcff933c46df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369004, "uuid": "96525472-ef00-43e1-a4fe-04a8de911b51", "comment": "Malware payload (Formbook)", "value": "198cd8b2f7aaaa8bd3f53213cc39ea6b2d5f7bb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369004, "uuid": "328afac4-a0df-448d-8ac6-a760f3358bee", "comment": "Malware payload (Formbook)", "value": "451f1e95a4917349c83539c798f01c1789802d5b9a29021e8ecca96242127ff281ddabf7e23c1474c500bde5fc6f8100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369004, "uuid": "c7d493aa-9710-48be-a280-462964be5c12", "value": "T1C9351224265DE803D5960FB41D72D2B057782F8CAA22D303DFDDBD9FBABB6A12844345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369004, "uuid": "72c396a9-8316-429b-86c1-3b160561ef5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369004, "uuid": "abba15e1-7035-46d2-89cc-a96cf25d0da3", "value": "24576:ka6UwlR58YA5HbOhTe7dAfSI5WxBYzGqifHakQD0:ka69lR58YAtOE5I5tSqEU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369004, "uuid": "25ac571b-a667-4531-b3bd-a0a9a78b96f4", "value": 1084928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369004, "uuid": "495f5d66-ce4c-44d9-a887-30269926e0af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369004, "uuid": "f933b041-0d8b-4508-9320-a4e7a7edadc8", "value": "976529425f33163b3ce6c6edefb343aa3751472a2232d7d2cc72dcff933c46df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33700fa3-9463-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786328921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328921, "uuid": "58e11e25-c2a3-4a99-a015-59e3f2b7d33a", "comment": "Malware payload (Mirai)", "value": "dff17bf4f87aad1f1fde602d1bddd1a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328921, "uuid": "65a2c5cc-2c3c-450b-be24-23d165e0971e", "comment": "Malware payload (Mirai)", "value": "98196b4050ff4ef422082b82e54b63570955e0fdb2fcb8ec5a0783d6d97e2264", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328921, "uuid": "75aefaa7-25e1-41e9-a688-fab8844ff462", "comment": "Malware payload (Mirai)", "value": "d15ceee338fd9f91fef30d48499fc3eb984c5e01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786328921, "uuid": "46867ba2-fb53-453e-bba0-85fd9460f0f5", "comment": "Malware payload (Mirai)", "value": "23a86b8ce4f6228abb8e11981988b43504778e09bf3470720826dc2fdcb188435b13ddebf7c33c52a5765120918834c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328921, "uuid": "72b2518e-d5b0-4d5a-9120-96e1e70a2d36", "value": "T10883D506EF550FFBDC6FDD3706A9070225CC665B22A93B3A3534D928B55B24B0AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328921, "uuid": "b44f35a7-1292-40e1-89b1-93f648a57444", "value": "1536:D3qYhpgNaGTdS3hYY4Z20uc8c3/aZ0U214Vl93yrY3Y82Iz0Q:D39hpgvTdSJTc8ia/XGb82q0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786328921, "uuid": "10f95c64-2d3e-48b5-ad65-42faffbd1914", "value": 85300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786328921, "uuid": "309ad1b3-db48-4088-9ac3-7971e814e764", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786328921, "uuid": "caa9e480-e977-4d96-b0e5-41a66469cfa7", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf4039d-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786373037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373037, "uuid": "43ff0769-003a-4f06-a701-a1b6762a6a6d", "comment": "Malware payload (Formbook)", "value": "f086b53c7a3836694a8a3161f630657f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373037, "uuid": "1d4f811a-f177-4561-908a-19e8587a43e6", "comment": "Malware payload (Formbook)", "value": "983138aaea5f4123933dc6f0ca33e35e9a087c5e8cc20e6bd118a7cd56981f32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373037, "uuid": "6bd74243-6d72-40ef-9e9d-a601a3977c2a", "comment": "Malware payload (Formbook)", "value": "bce939be25a9a06b3009786c83d8a9a731228212", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373037, "uuid": "519b30e0-8ecd-43f8-9741-39cb8259bd3c", "comment": "Malware payload (Formbook)", "value": "83fc2c5c758a5c1034e0da5ed9a396ba49ce18bdeb9c144eba3354781b1db1efbe6ae588d0566edea07daeaf669f81a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373037, "uuid": "2bca2cc5-7aed-4ee7-ab2d-5e6f6c400467", "value": "T117350154232ADA01E1D687F6B8A0D37433B41DCF78E2C3964FE56FEB792D3842954292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373037, "uuid": "50e74c1a-b665-4aff-abc8-6e9b2966086a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373037, "uuid": "7fff6adf-e263-4d93-996e-6bf6e2cd62a5", "value": "24576:aip50yzA4GJVEQvpIitp1Po5Jf0MX4aJcuhl:rpzAPJ1vq0TPo7FROuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373037, "uuid": "85cfd2f3-98fb-4c96-ab8d-996b0206efad", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373037, "uuid": "830b9a83-96af-45aa-bc2b-ca51adaa10f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373037, "uuid": "8df4b5b0-0d64-404a-a781-e6c15b919035", "value": "983138aaea5f4123933dc6f0ca33e35e9a087c5e8cc20e6bd118a7cd56981f32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2308a43c-945f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786327175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327175, "uuid": "afffcdc8-9242-4161-a0d4-3ddf2ed4a824", "comment": "Malware payload (Mirai)", "value": "6df0f866bfc65e4701dc50a3888c4ca6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327175, "uuid": "af9a873d-5cb8-45f2-bd20-cb7ca1a4f0a4", "comment": "Malware payload (Mirai)", "value": "98497bc74a1bb5ff9750cbeb785bc245ccec38d570b3ccbdc88861dee6b2a498", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327175, "uuid": "b4672fe3-e9fa-4676-9a03-1894b0c28650", "comment": "Malware payload (Mirai)", "value": "8024164bf7336e2b2ae0996445eb45eac3de2fc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786327175, "uuid": "d9ddba03-60bb-4943-b9c4-9e28eda0e1ef", "comment": "Malware payload (Mirai)", "value": "09a930b1a11f9059b3e53f3eb8f28f230492721656b29f19491c7f18730e4ae21e6513ce8d8779b93ea6884105f0b371", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327175, "uuid": "1b588e8b-bbc8-428b-94d0-8fbfaa4e181e", "value": "T1FEF2E17BEDC9A269E750183CE838C203B321186484877F703195CA6039C6B67FB796E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327175, "uuid": "075c4afe-952a-4673-9320-d486a07ed101", "value": "768:zDcN8in1nNDvuT7k52wmyVeSnQKLOKcfOHaCuk1BwUq3UI2VY:z4+y1nNDo4sw8KLOKqCuk1yCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786327175, "uuid": "52d5ab66-a8bd-4288-9620-423a01b0bef3", "value": 36608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786327175, "uuid": "67a5b4e7-6aff-4124-ac0e-d98e402f4f4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786327175, "uuid": "3f99f25b-e47f-476d-ab0a-14e4227befdb", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2776a2-94c9-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786372667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372667, "uuid": "71a4feda-1c24-444e-be8d-7fe7e296fb99", "comment": "Malware payload (GuLoader)", "value": "32c3deb1393d65c39052b862b2525598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372667, "uuid": "825f7629-b293-4d43-8bf4-2c75c30b1f4c", "comment": "Malware payload (GuLoader)", "value": "9856e1947303d24a288bfda2c0523a9d111cda99ca7a3968d45a0b74971330ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372667, "uuid": "f94f66e1-4835-48cc-bfc8-4bced387b58f", "comment": "Malware payload (GuLoader)", "value": "2116dfdf180edf7ddd2a1f1d50f13e6735e1ccb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786372667, "uuid": "b9854189-7bf3-492c-b556-debf9a2ac4bd", "comment": "Malware payload (GuLoader)", "value": "122a0714e6b82311dfc03d2f6dfaecf3fecfd5147ee0fe7c10abf83428cca32c47343399c20cd3a5672e8783ee37812a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372667, "uuid": "2f535e71-f43e-4ad7-afd6-8b08e7f03756", "value": "T16D6412553686C427C0619B70CC7A89F64518DEF6CA27C30BBB19BFA97A701D28F0D396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372667, "uuid": "865c0175-ea52-488e-9097-56772882bc59", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372667, "uuid": "fdc02635-6cdc-431b-949b-797380809bd5", "value": "6144:yB+pgU8O2WlqNhtWMZg2q0RpeoRlffJ6Zd1tW0Esu42BuPb4J7+exCAaFRTm:ygUOxlCnW8g2BRpe6f/0Es92Ib9q8LTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786372667, "uuid": "09425943-d6ac-49d8-a84c-f048c9b8a9d6", "value": 311832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786372667, "uuid": "51a3377e-6d48-4461-922e-df177bbfb1dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786372667, "uuid": "01ef956a-b4ed-4d0d-85eb-e7f2bfc94483", "value": "9856e1947303d24a288bfda2c0523a9d111cda99ca7a3968d45a0b74971330ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c668cb4-9482-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786342169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342169, "uuid": "325668b7-afa6-462c-ae08-cb4d823254b2", "comment": "Malware payload (Mirai)", "value": "3316f3e502d4f481cc501f3d104920dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342169, "uuid": "624e7e7d-fb7a-4622-bdc5-bd2ef59723d2", "comment": "Malware payload (Mirai)", "value": "985b25cec977ee124c1c37a61b11fd1aa1a9684c86e27d253d39e529152b99df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342169, "uuid": "f6507a76-d52e-4896-9b1b-b01d8b78a85c", "comment": "Malware payload (Mirai)", "value": "ebb4ff35faf7a12fc358823fe66f1ec41c65bd67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786342169, "uuid": "6db40b1c-f581-4747-9275-4a79132bbbe5", "comment": "Malware payload (Mirai)", "value": "c0639ce1819e890cfe590b9b83d2cfb8092ca2933f7cf16bbed1f56ec8f357ae8e5216324a0893035fe2fd7a14c2460c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786342169, "uuid": "08df932f-35ab-4a19-a229-929ad734fdd2", "value": "T1ADA48D44B54F7D52D3D7E2BCEE0DCAA1B20B79A8C1A360B27E43434CC1669E1CAF5961", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786342169, "uuid": "17599f83-e056-4c23-ab8c-a41756e5727b", "value": "6144:P54jSaOrB96yy8i7QqQxqnCUGv77EBIPeOz+E6MRafB+ASdSkq:BKStlYQ4nC977jWIwfBR+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786342169, "uuid": "6f9f56bc-bb78-4e4d-8d07-04c2e6606317", "value": 480432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786342169, "uuid": "ed404b34-8fe8-45e4-a9fa-660f39fcb642", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786342169, "uuid": "3d9a810c-e373-4563-bb2c-464ce4954f9d", "value": "985b25cec977ee124c1c37a61b11fd1aa1a9684c86e27d253d39e529152b99df.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32cc50a-947f-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786341188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341188, "uuid": "3ef32461-6dc4-44d3-932a-9c300448f591", "comment": "Malware payload (ConnectWise)", "value": "e10c908084a0f5c95b1d3eae437d4db9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341188, "uuid": "99c4f4ea-5c03-4657-a910-c8ec6ab763ec", "comment": "Malware payload (ConnectWise)", "value": "989534e8cc8d4a18a9d1e2bf0d3c6492a66a7cc79cdd0c600b5f427d980cd23f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341188, "uuid": "bce38d09-52af-4b20-84b8-dfc829889351", "comment": "Malware payload (ConnectWise)", "value": "253aeb12fab4fb1df322f451f2ecf87c2b9a7529", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786341188, "uuid": "557bffeb-2ab5-458f-8020-32e026f9c755", "comment": "Malware payload (ConnectWise)", "value": "f189eadab4114e12bfc97b19e53a95d4fe36adc0d0bcb041602a8e92161bc4ed6edc7c21ecdc9040fcc67b11f9bcac04", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341188, "uuid": "18c03225-c517-44d2-926e-ed9bf654e0e1", "value": "T1DBD61211B3D694BAD4BB0638D87A52655235BC148762C3BF6790BD6E2D32BC09E32373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341188, "uuid": "de6a00f1-f777-444f-bc48-5e69b216da7c", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341188, "uuid": "c20a42bb-144e-4284-9f1f-645369425357", "value": "196608:1c8fefPSoHQjDSOgtEPDDoHQjDSOgtSDoHQjDSOgtkDoHQjDSOgt6:6QowXS2/owXSUowXSWowXSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786341188, "uuid": "a1119051-3a57-4330-83d4-c9e0d2835eed", "value": 12803128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786341188, "uuid": "59c0a7f0-deec-411e-879b-424d9b9681c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786341188, "uuid": "e1c49eeb-5f72-4cd4-b4cb-c8ce46a6c15c", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7098cfad-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1786374120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374120, "uuid": "22fb4274-db2c-4748-b387-ef8350520cf5", "comment": "Malware payload (GuLoader)", "value": "cf733e17734a1807c81291ce184e220c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374120, "uuid": "ac3df2d0-8b68-4005-a347-d1526fdfe500", "comment": "Malware payload (GuLoader)", "value": "98d7f98e3a4aeeb62a91d5c90292d1ff10aa46241a72968b686b77ab83798376", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374120, "uuid": "ea657899-d8b1-405f-a46e-032ff588360b", "comment": "Malware payload (GuLoader)", "value": "56c81f546d1d51396a2ccd47f53439f8111ed8ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374120, "uuid": "1eeaf61e-c338-4ad4-a4b8-528e5b0b5b47", "comment": "Malware payload (GuLoader)", "value": "84048e43b27f390d8f18f169da2510b4820b8b0805d3fc47211d1577c886c700966eabe87967d32682d458f8406a7184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374120, "uuid": "c7ee009b-0b30-41ea-882c-d03aaf331589", "value": "T124848B67FA63C4FBCE7813F2B5C3E5BB1DFD6456AC94909967E29A937000E321A0D124", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374120, "uuid": "9e8522bf-7f12-4412-9366-f4b2c5c6d9a9", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374120, "uuid": "d1eb04f1-862a-41ad-be92-3894c2555c1c", "value": "6144:Yz20GHu6JDLDQSP4v95xtTyxYj1K4Vw8qxI8t5AykX/AEKsR/UHe3X:fDHVPWtl44VyxXTAykYENFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374120, "uuid": "1834d252-6f79-42ef-a4c7-6c6d3ad42fdf", "value": 377904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374120, "uuid": "f0798f88-a284-4ce1-80f6-86430de332a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374120, "uuid": "14d33852-81c7-4323-b73b-7f59f5facefc", "value": "98d7f98e3a4aeeb62a91d5c90292d1ff10aa46241a72968b686b77ab83798376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2494a16e-94da-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1786380006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380006, "uuid": "b07ec64d-29e3-4b95-9073-61536822c5c8", "comment": "Malware payload (NanoCore)", "value": "0c7777f8a20db42cfa577f16e8eab797", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380006, "uuid": "70d62fe4-8104-41ec-b2ed-070d0e05c425", "comment": "Malware payload (NanoCore)", "value": "98df0a98985b1d5cfc8278f8eb65adab2e5c5a512cbc02dac39abc5f265a7344", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380006, "uuid": "db891f3a-6fa4-43be-8ee5-f1e0073f011d", "comment": "Malware payload (NanoCore)", "value": "67a72320caede2dd6055d9f48c9348770480a5ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786380006, "uuid": "c250ba0c-ae45-4b41-9bfc-6ae46f0bafc9", "comment": "Malware payload (NanoCore)", "value": "284c768802cdbad64dcb7702f35f71cbb9b3a84964daefddb85a52b1b45b932fc8f51e020b73a1b59becb230c456bfc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380006, "uuid": "3e28bfdf-a9e4-4a92-8673-d3bccff1981c", "value": "T18B14CF567BA84A3FE2DE857D601252139778C2E39CC3F3DE18D865B69B263E00A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380006, "uuid": "dd9ba189-0b7f-4cf1-927c-8b67b08cf62e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380006, "uuid": "93b8a069-b060-4f0d-a2e8-4508e9f0615d", "value": "6144:wLV6Bta6dtJmakIM5CjaSdHlHMLHLpnN5g:wLV6BtpmkV3FmHLpnN5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786380006, "uuid": "417af0a7-3f3c-4deb-b45c-c33761037b19", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786380006, "uuid": "5896945e-7497-41b7-8ed1-9f2e5f3927f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786380006, "uuid": "2841c50a-f813-4603-849b-8dfd318ffde3", "value": "0c7777f8a20db42cfa577f16e8eab797.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be94e72e-948d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786347193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347193, "uuid": "0fcfc7b9-6a3b-45b3-b022-8169554e971e", "comment": "Malware payload (Mirai)", "value": "46b7100dd69f46ee3c6cea7ea0234408", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347193, "uuid": "33b32aa8-9c69-49b1-bb4f-9077df5be9c4", "comment": "Malware payload (Mirai)", "value": "99c11447a1238a6391b69d113124034bf106cf78b1751dfacaf7181ce803f88e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347193, "uuid": "2d025dcc-067f-416f-8dbc-677914105998", "comment": "Malware payload (Mirai)", "value": "56bf631a81c3699b8e816f53589a27d20cb26c50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786347193, "uuid": "1ccad406-fe90-4a82-b5a6-0cb2972d129b", "comment": "Malware payload (Mirai)", "value": "7918dd5f71db67ae24e36196e30d080bb92a93f85295dab9ba60c8290e4c26938afdfdb2ff7636c247007278e8163255", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347193, "uuid": "4f75c9cd-27e4-42a9-a96c-d67ff54d761b", "value": "T122F44A56F8808F62C5D1267AF65F42A8731347B9C3EB720699188B343BD792F4F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347193, "uuid": "402570e7-3266-409c-8902-b68362952e7a", "value": "12288:mA+8gcxYhR4TYwVpuX+coDRSFgIvEDVMpxXi0xPO18pCCCjobvvrwT6y5zxZPJhm:mADgcxYDQVpzFDgFgIvmV8xBCEAT6y5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786347193, "uuid": "1e586cbc-caa1-4f9a-af41-3c2ca3444b20", "value": 751400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786347193, "uuid": "ea9a01b3-ad11-4ff9-a629-ad3622bbf073", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786347193, "uuid": "1c55d75c-8036-4d22-8112-c173892f4785", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef320620-94cb-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1786373903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373903, "uuid": "4a7e0bf3-faa1-40e2-a4c6-2d8f6fdd3f44", "comment": "Malware payload (PureLogsStealer)", "value": "a97a27e4b95e0a9d06a27a71d01d65b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373903, "uuid": "82d93992-807f-4750-a909-2e3d436822f5", "comment": "Malware payload (PureLogsStealer)", "value": "9aaa59b37a55df8b5b87c64a828067baa6c0e8ace9d5a46412acd31c5d20ad85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373903, "uuid": "2159a626-37ce-42c6-b687-90e3389cc5f1", "comment": "Malware payload (PureLogsStealer)", "value": "403930ebd8b292721a7ac4af6148794220596639", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373903, "uuid": "dd074d41-4f82-4608-894f-a6ade171c2e8", "comment": "Malware payload (PureLogsStealer)", "value": "25c4f15869f19f2eb3cad536d03c65578f2b77a84e2be17fb58c348cba55277b9ed8d52d705c2cd3b393c3836eaa7f3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373903, "uuid": "7cd2ff6c-1004-41b4-af80-211904decb9a", "value": "T16D75239A9AB5D302E8BD2BF106A4E63013FE6C0DA212D2575FE52DCFBA17B101C05797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373903, "uuid": "d0406e6b-a16d-46c4-87d4-cafaef29c5ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373903, "uuid": "1297407d-7e77-4801-bb4c-35d4529b0401", "value": "49152:MW1NOhpnYTobKwwbwc5JFaMoXGvLxJ+D4R2:JOpnYTxKNXGTDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373903, "uuid": "c7895e57-b20d-40b5-87de-36a74d4dfd1e", "value": 1602560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373903, "uuid": "c278edaf-866c-4fea-a52b-03eae262e085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373903, "uuid": "f9122bec-2415-4506-af14-6ecf2dc7ec45", "value": "9aaa59b37a55df8b5b87c64a828067baa6c0e8ace9d5a46412acd31c5d20ad85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b8756e-9493-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786349616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349616, "uuid": "70368491-9e45-4fa7-b2ed-14880b8827c4", "comment": "Malware payload", "value": "1109ae36c84ffea5a24c444e745aa0cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349616, "uuid": "3edfaff4-908a-4d42-81d1-c5d0470677e9", "comment": "Malware payload", "value": "9ac880622694166a43903121cb536c14018e6e88c4c53d2e44469d63642dcb95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349616, "uuid": "529cafe8-e63d-4c6b-8b31-b9a524240566", "comment": "Malware payload", "value": "8d2d3dd9134548767125a27d0921e72d832eaa38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786349616, "uuid": "e662c9a7-8cbb-496c-b7c9-84a52813b996", "comment": "Malware payload", "value": "a078dd503b7205b2992ee2b3668026aa4950b673beb78f4b6d4fa2c00dc65cd1cab72b2bf09f9fcf820c6377b5c9ce6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349616, "uuid": "d40962e7-e1f1-410f-96dc-3453d7003062", "value": "T183363817AE9158FAD099E331C8B74115BA74B80D8B3123D32EA1BEB82F327D16E35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349616, "uuid": "53c40aac-820f-4bed-acf7-8a11c83b3c21", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349616, "uuid": "83d947e2-54df-4764-8df2-50784a274260", "value": "49152:r0D1TyiL03tCxMYXysc5LOcNKKiAw3KFcWGiAFJDUde+9aEp7TuMESPLfjrZGHcG:r6lUGsqAw3KFcvik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786349616, "uuid": "26114a09-9dbc-4377-a52e-7c8d1cda08f1", "value": 5292904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786349616, "uuid": "6dcef819-f8f5-4a87-a24e-c751a67e902e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786349616, "uuid": "711cdb53-306d-4f78-9e43-daa0cb13b3c0", "value": "1109ae36c84ffea5a24c444e745aa0cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513bfb1e-948b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786346150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346150, "uuid": "59db05d9-166f-471c-a18c-d6879a0839bc", "comment": "Malware payload (Formbook)", "value": "ba347ca5a361abf2e7c24e505f0c8b6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346150, "uuid": "cead4493-46cc-400d-a087-27a7b66c7925", "comment": "Malware payload (Formbook)", "value": "9ad3e2c70d39d128d94bf6988c2dc94a5fa63d125091c09d88143b04583e301d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346150, "uuid": "0306a9d8-d5ef-4db4-aa0e-ab18844fcfef", "comment": "Malware payload (Formbook)", "value": "b11b30710c5520fae58880d63fcbaaccdf3c6985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786346150, "uuid": "cdc67db4-9add-483e-863b-a6c77692779b", "comment": "Malware payload (Formbook)", "value": "e8415e2bb9c6de6b6c6e2d7c99a0d383c6105d5d9f9a989097818e52ec24853e45a8e564a92bb5242d1f5e862a5df600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346150, "uuid": "9f49f651-9135-4675-bd61-bad754d02e4e", "value": "T1DA35014023ADEE15D0A38FF419B0E77407746D48B920E20A9FEA7DDB797A78568443E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346150, "uuid": "c3c45183-c62d-4825-97fa-9d5caa13ff68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346150, "uuid": "4e3a543b-300f-4ae2-b07c-7e479151aba8", "value": "24576:+HWpGWVIh8oYObXjrfkrlS8wQ/QXpfNsvSg:rxIjXPfAShQ/QXNmvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786346150, "uuid": "a1219a75-475d-4368-8aa7-ee5425cd3917", "value": 1110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786346150, "uuid": "957e0133-fa09-4959-9103-5dc33bab3c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786346150, "uuid": "6c35a3d3-eb13-416f-9bbe-3bd7b2826c55", "value": "0BUYA7GaNiooeTq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dad0a82-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786369391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369391, "uuid": "e53f1183-d1ba-4d73-99d4-a6abe2a83a29", "comment": "Malware payload", "value": "4716f34d1939b7b43e968f46386e40ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369391, "uuid": "442702c3-431a-4a60-b0b2-70e99289118a", "comment": "Malware payload", "value": "9aedb450cd3e1b2b072f0cf4c9a758836fa01f1295df80b2f2f8cf9eea9e2be6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369391, "uuid": "a2bd77a5-f18c-4343-8d4a-3e8a3faf01de", "comment": "Malware payload", "value": "dd77d9c67dd009c5ae00807d67996b53a26e12b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369391, "uuid": "72b9e68d-b645-4d54-9ffc-3b3e27662cb9", "comment": "Malware payload", "value": "2fea7625e9e082487fd5b72bdc54efe7b519c95e6820ddd3c5d6474d735adb175ea5f2bd81854d8dc5363e334662e5b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369391, "uuid": "b25de38b-341a-4b10-abb6-7ad042995f93", "value": "T15035F1194E863A99CABE5FB8C1660C9837F0D84793D6D7272FEC01F59AA3B84CD17442", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369391, "uuid": "7caf8eb1-70f3-40e2-ac57-a392b3632da5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369391, "uuid": "5d186f9d-5df2-4534-91ab-c2351f0bab5c", "value": "24576:NxHqqigNf0NSIXtbJXsFxWIvSH1zKu1D:NxHqP200IpJXixWoo1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369391, "uuid": "1c1b99b5-9e98-499e-8f92-bbcdcb0031c0", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369391, "uuid": "4164ce7a-c8ea-409a-8c62-fc8300244cb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369391, "uuid": "d94f4324-75c4-46c7-a9de-2d6e422f3d38", "value": "9aedb450cd3e1b2b072f0cf4c9a758836fa01f1295df80b2f2f8cf9eea9e2be6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d44fd18-94c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1786370571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370571, "uuid": "144c01a2-19bd-42c4-9410-9874828cc1d4", "comment": "Malware payload (ArkeiStealer)", "value": "262970e715f1c415a019cb8d6dd769f9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370571, "uuid": "df7b667a-c763-498e-a723-73084991c31b", "comment": "Malware payload (ArkeiStealer)", "value": "9afc920618109d9bdf027a563d0445df289660e25ad80acb42d5941cabe2f290", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370571, "uuid": "b974e33a-a92c-4bc7-a680-ecd558242fce", "comment": "Malware payload (ArkeiStealer)", "value": "c5c44545d5331972ac74a3ffe74b873fbfba34da", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786370571, "uuid": "1fc8f596-7e63-41c3-b8b4-cb91f6f2c66c", "comment": "Malware payload (ArkeiStealer)", "value": "c131b6624d7fabfc7bbfc871668b65f6a966ea9bb39a385c4d86a8f1d35d21f0f514e8dd10a3e6739455d37f1d37bf3f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370571, "uuid": "1267cfd9-b31a-4ad4-8fd1-3eff6c9507c2", "value": "T13BE59D0BBDD409E5D49A927698B242867B70FC4A0F3263D72E80B3783F756E09D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370571, "uuid": "8edbda10-d126-46eb-be45-9133e6ea567c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370571, "uuid": "81409569-2aac-45cd-9dd1-dd2bc7adc9bd", "value": "49152:gTudpTwXugfEatDMlOV1/NcPrrplc+aab9BCZNUg883hs9qvkpANbF:giEOZli/IfI8BqzZkpA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786370571, "uuid": "8dce1017-4331-4d67-b02c-3322ebce57a2", "value": 3115520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786370571, "uuid": "1bd8170f-cd61-4aa6-ad23-ab8ba99f6e44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786370571, "uuid": "21b0ae45-a558-40ff-b0c9-e35fff7dff84", "value": "9afc920618109d9bdf027a563d0445df289660e25ad80acb42d5941cabe2f290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04c8308-94cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1786374200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374200, "uuid": "dd27a8a1-7577-4253-b437-176efc84a9c6", "comment": "Malware payload (Formbook)", "value": "aa6570c00f4d39c1580e5772bd8c6cbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374200, "uuid": "c0aef3ec-1880-4b81-ad53-100db88ac67d", "comment": "Malware payload (Formbook)", "value": "9b1b95c4aacfc7ac8dd3300424eab82dbc599cd2bc219ca5b2964cf2815805d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374200, "uuid": "b70e7a18-3e27-4837-91e5-967479493c91", "comment": "Malware payload (Formbook)", "value": "e4d9df5f01a47c816ad140661024487161ea3b1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786374200, "uuid": "ab6ed77b-3858-44cd-927e-180227ccd31e", "comment": "Malware payload (Formbook)", "value": "d4e4b43bab2a761f03b8b29a8b2c0fe19381b466a44e39bfa65084435a72d9370d73ba616029afef027a550d59e871e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374200, "uuid": "3a7cc206-d3d6-406b-9774-a84862911f98", "value": "T14064121727B1D81EDA4B19F08C7AEB7D5FB14F0060A6470BDB20BA4E3D73565292E683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374200, "uuid": "c0940122-909d-4081-87e0-cc1c4cf07a9b", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374200, "uuid": "cec783c4-4504-4115-b251-87e7f352072a", "value": "6144:M9X0GN6Bo9PMbSDWUOKMRaEUrEjwT2Eryemwrv7zdFx0GYVpm6iNn:C0MOo9PM+vxEMGwT2EfVdvRdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786374200, "uuid": "23ef81b0-be25-4752-b12a-d99bf575d2b0", "value": 317976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786374200, "uuid": "e79ee0e7-be54-4974-bdb8-9dfcdd18e984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786374200, "uuid": "6b5d4f7c-5af7-47b9-8361-7faa2b10c6a6", "value": "9b1b95c4aacfc7ac8dd3300424eab82dbc599cd2bc219ca5b2964cf2815805d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6e4db9-94c6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786371508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371508, "uuid": "840ca343-f85d-41b9-ae3c-9a30e9cc8a73", "comment": "Malware payload (AsyncRAT)", "value": "12236c7e2d7acd537eec932ffc042da2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371508, "uuid": "f3204698-b80d-4fea-a5a8-7828dc58073a", "comment": "Malware payload (AsyncRAT)", "value": "9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371508, "uuid": "394ed650-0ba9-482a-ad02-7a1548f80bef", "comment": "Malware payload (AsyncRAT)", "value": "9dce57fca6edadb4f1bdcfe9c96bbfd9d89e432d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786371508, "uuid": "d5f13abe-39f7-4c57-96cf-9323bb93c3ca", "comment": "Malware payload (AsyncRAT)", "value": "94235d97947f3e9da3637e8ebde5daa8a0981e46139d61f5eac37740e9048e043501a65057371917ea88689ff9b22e51", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371508, "uuid": "f9211ad3-2dfb-4e60-a4fc-52375a4e90de", "value": "T1A2F4125C2A49D903CA6543B58FB5F37862A95DFCB811C3139FEDAEDFFA25A008C44186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371508, "uuid": "97dc2052-314a-4668-a7e9-9606861f8384", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371508, "uuid": "29bde7cc-5d5f-491f-9a0a-6919532a10b8", "value": "12288:DlJdbv0EcfJGtMQ8YMtkJf89E6OuoQ4P2dHGzPY7+V0MP81fTY48kCRKwicUL:D7cfJGtMQ8Y984CGzBk9TYVvRKwgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786371508, "uuid": "43b3145f-b66f-4bf3-8fbb-1e63ece9b071", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786371508, "uuid": "6846f478-5f36-43e1-8b52-123c85fa97b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786371508, "uuid": "51152af5-fea6-4910-8513-6098f1a7d3aa", "value": "9b1e1c36119081b3f84f1ff1548615d76b82408e4e323921469d11231ac11264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2681bc-9484-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786343028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343028, "uuid": "87ce5e7f-6ae5-4f90-84ba-afc9beb7b987", "comment": "Malware payload", "value": "0e4945852c609c6f29e078e5d1301b39", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343028, "uuid": "6c60216d-1ff6-4ab9-82b1-535d00aa89c5", "comment": "Malware payload", "value": "9b21a1cfe97d251f28879b61514f00d5827c8cc42e863e1712d748423e703159", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343028, "uuid": "f9270a06-5aeb-4787-8031-e3ae189a6a33", "comment": "Malware payload", "value": "166dcb6f2c884534504058f069831d705b400ad2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786343028, "uuid": "c542f38d-a1a0-49f1-bbc0-b4bac285403d", "comment": "Malware payload", "value": "367476a11f7ed099ee96ef417517c7aaef687402e6fe30cae11d68d3d81af6ca8c2392b5d7f5749a3e4508910c3a1ebf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343028, "uuid": "6e276297-66d8-45cc-bb44-ee5cd3673095", "value": "T107236D6626857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5A69DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343028, "uuid": "6ba24199-1f46-43c5-8c57-2b2a0c66d3cd", "value": "768:RXRWNGxVG9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:rlx9cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786343028, "uuid": "1c13b78c-3ee9-49e3-b144-792a06ba429e", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786343028, "uuid": "bc9dd644-a38a-417a-8b68-995912970122", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786343028, "uuid": "6da0fc28-11b8-4bf3-92b4-aaef067729ed", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5b8406-94ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786373172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373172, "uuid": "177e8eaa-8b3b-4817-ba17-f6a0d6ba4a43", "comment": "Malware payload (AgentTesla)", "value": "75a3ad7ba10a98390641b21d90c086fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373172, "uuid": "7b1faa88-7852-4376-955f-81c427a7c75b", "comment": "Malware payload (AgentTesla)", "value": "9b2e17315099fd4f4442500c739242b54f4ab424f809173b9a1bf84de0d28ba6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373172, "uuid": "f324f2c3-63ef-44f2-8ed1-f99883c574ff", "comment": "Malware payload (AgentTesla)", "value": "16a1d4f3fd6d4345b806753e5fd14aab69334083", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786373172, "uuid": "1b97848e-07c7-4568-8a26-71e959281f27", "comment": "Malware payload (AgentTesla)", "value": "f4befdf0b79a3d933852b5077f5ac5b979ac473e051709dc02938bcc5f4607d8344ac44bcffd3a643cdab68aa63b51b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373172, "uuid": "cc322417-6b3a-442b-9252-48de31294f5b", "value": "T1313501551312DE42D0D68BB7BA60D33432B50DCF79E6C3929FE62FF738193921968682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373172, "uuid": "07a0a98f-9b3b-41ca-b08d-67e5654eb97d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373172, "uuid": "913be971-fa5d-4100-be16-2419ace6b75b", "value": "24576:op50w2pHAqmtk1z5UrlE+hMsRQF7gYLxFdqhWFtrYcj/P:opR6gztIW++hMsaF5/tkY/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786373172, "uuid": "d039150e-a4d1-410d-963c-73ebd47c4c4e", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786373172, "uuid": "9f060098-08a5-4f92-aff6-83b1f7ad13cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786373172, "uuid": "4c3e596c-193a-453e-b472-320803b7d5bd", "value": "9b2e17315099fd4f4442500c739242b54f4ab424f809173b9a1bf84de0d28ba6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28dad80-94c1-11f1-bd95-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1786369560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369560, "uuid": "9e1e7a15-827f-441c-96aa-bd037cfc9c03", "comment": "Malware payload (DarkTortilla)", "value": "cf3bded02abe1fa1caec1a8962f61791", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369560, "uuid": "d6f794e1-df2f-41d2-bbe7-fb21364b33c9", "comment": "Malware payload (DarkTortilla)", "value": "9b6ac075584a853e270eeaf480e0baaa415ca187b54c5c04c53bfb3d3aa87a1c", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369560, "uuid": "ea2568c0-8e18-4090-afb1-cd00482afe51", "comment": "Malware payload (DarkTortilla)", "value": "2292456956e0da4d0c9cbf5d765e7a112819b57a", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786369560, "uuid": "85ee9a63-012d-4eea-9282-1f77cb8a954d", "comment": "Malware payload (DarkTortilla)", "value": "5fa187993da040a762becd876f5d36f4b36182f976fe21a78d6c4821714da6d0c4110d887a021f0afc1f924ac9d352fe", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369560, "uuid": "38f3699e-2717-4641-a755-dcbdbe0b82ec", "value": "T13B75E0275D8261AACCDD5E34C278365C63F095CB2303DB922AE822F99F73B466D43C56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369560, "uuid": "5fec46b3-7845-4dda-89b6-2347241573bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369560, "uuid": "35e63845-7024-47fb-bb52-4029116b3c75", "value": "24576:48qqigNf0NSIXtbJXsFxWMa6S3JpITsIra2eT6khAnWeWe42Hn4j:48qP200IpJXixWT6BnuMWeBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786369560, "uuid": "55a4e67a-7372-49c3-a42a-245831ce9ab1", "value": 1688064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786369560, "uuid": "2d5c5fe0-2ac4-4e77-b81a-941a243f1929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786369560, "uuid": "bd88f868-2677-45bf-9b4b-59f3e9e17e6d", "value": "9b6ac075584a853e270eeaf480e0baaa415ca187b54c5c04c53bfb3d3aa87a1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d3ab53-94ef-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786389373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389373, "uuid": "5de213e6-1fb4-4571-ad91-d0bb7dde660d", "comment": "Malware payload", "value": "98ba8782e10c9592f17dddee12bbd7d7", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389373, "uuid": "c0bb6181-a3ee-448e-af74-72784df84138", "comment": "Malware payload", "value": "9bd2cb4000ba90c8ebe57799a5edf3b2fee9555a2a5eebf40e091e45ef78edb5", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786389373, "uuid": "b59a2abf-e6af-492b-8697-554059e830b7", "comment": "Malware payload", "value": "c9f2f957a737f07f8af7386c37f455b66d477869", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true,